AI Agents Do Not Need Their Own Identity System. WinMagic Says One Architecture Can Cover All

With machine identities already outnumbering humans 82 to 1, WinMagic argues AI agents should be verified through a common trust architecture spanning users, devices, workloads, and machines.

TORONTO, July 28, 2026 /PRNewswire/ -- Cybersecurity teams are preparing for AI agents by adding new credentials, policies, and controls to identity environments already divided across users, devices, service accounts, and cloud workloads. A 2025 survey found 82 machine identities for every human identity and that 70% of respondents considered identity silos a root cause of cybersecurity risk. Thi Nguyen-Huu, President and CEO of WinMagic, a cybersecurity innovator known for endpoint-based authentication and encryption, says the work on AI agents' identity is necessary but it should not become another identity silo. The architecture that covers AI agents can cover users, devices, service accounts, and workloads.

What each of them needs is a trusted witness at the point of access that can confirm who is acting, on what platform, and under what conditions. "Identity is what you verify before you give access," said Nguyen-Huu. "Online, it cannot be the user alone. It has to be the actor, on a platform, under a defined set of conditions. Once you define identity that way, there is no reason to build a new architecture for a new actor."

Identity Has Outgrown the Human User
CyberArk reports that 42% of machine identities have privileged or sensitive access, even though 88% of surveyed organizations define a privileged user only as a human identity. AI agents expose that fragmentation. They can access data, call application programming interfaces, use enterprise tools, and act on behalf of people or other systems. The National Institute of Standards and Technology's National Cybersecurity Center of Excellence is exploring standards-based approaches to identify, manage, and authorize software and AI agents, as well as audit the actions they take. Its February 2026 concept paper proposes extending identity standards that already exist rather than building new infrastructure. WinMagic agrees with that direction.

"Adding a specialized control for every environment can look like progress", Nguyen-Huu said. "But it creates more policies and exceptions to manage."

Authorization Is Not the Same as Identity
Tokens were designed to carry authorization, meaning what an actor is allowed to do. Because tokens accompany every request, they gradually became a stand-in for identity, even though they were never designed for that purpose. Nguyen-Huu argues that identity should be verified in the communication channel at the moment of access. The verifier can then assess who is authorized, whether the approved actor is participating now, and if the platform and security conditions still hold.

One Architecture Does Not Mean One-Size-Fits-All
The architecture does not require every environment to use the same credential, policy, or set of security conditions. Organizations decide which signals matter for each use case and apply a consistent method for deciding whether access should continue.

In connected environments, the endpoint evaluates local conditions while external systems provide additional authorization and risk signals. In disconnected or air-gapped environments, the endpoint assumes more of that responsibility because outside services may be unavailable. If required conditions change, the Live Key, protected in device hardware, is no longer available for the next connection.

"A unified architecture does not mean every environment works the same way," Nguyen-Huu points out. "The conditions change; the principle does not. Access continues only while the conditions that justified it still hold. Until now, the only way to approximate that was a timer, which is a guess about the future."

Every Authorized User Already Has a Trusted Witness
For human-operated devices, the trusted witness is the endpoint. It can distinguish between an authorized user on an approved device, an unauthorized actor, and a legitimate person without permission, allowing access decisions without repeated password prompts or portable tokens. Unlike the physical world, where continuous observation is impossible, every online interaction already passes through a device capable of providing that verification.

MagicEndpoint applies that model alongside existing identity and access management systems. Mutual Transport Layer Security allows machines to prove possession of cryptographic keys during a connection, making AI agents a natural fit. WinMagic extends the same machine-to-machine architecture to people by allowing the endpoint to hold the key and vouch for the verified user.

The missing ingredient is not cryptography or hardware. It is a practical way to continuously verify people without repeatedly interrupting them. By shifting that responsibility to the endpoint, a mechanism originally designed for machines can also support human identity.

"We keep building new identity systems every time a new actor appears," Nguyen-Huu said. "The witness we need is already at the source. The endpoint is already there when the actor acts on the platform.. We do not need another identity silo. We need one architecture, and an endpoint allowed to vouch."

About WinMagic

WinMagic's mission is to secure the digital world through high standards and strong ethics. For nearly three decades, the organization has led innovation in encryption and endpoint security. Today, WinMagic is advancing a new paradigm for online access—anchoring the endpoint as the foundation of trust. By letting endpoints speak for users, WinMagic turns cumbersome logins into seamless, automated exchanges. What was once user-to-machine communication now becomes a machine-to-machine relationship, governed by policy and anchored in cryptography. This evolution eliminates friction, reduces risk, and lays the groundwork for the Secure Internet—where security is continuous, effortless, and requires no user action. Learn more at https://winmagic.com.

References:

• CyberArk. (2025, April 23). Machine identities outnumber humans by more than 80 to 1: New report exposes the exponential threats of fragmented identity security. cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
• National Cybersecurity Center of Excellence. (2026, February 5). Accelerating the adoption of software and AI agent identity and authorization [Concept paper]. National Institute of Standards and Technology. nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf
• Nguyen-Huu, T., Nikitin, S., & O'Leary, J. (2026, July 6). Condition-bounded credentials for workload and agent identity: Non-exfiltratable keys and validity by presence (Internet-Draft No. draft-winmagic-wimse-condition-bounded-credentials-01). Work in Progress. Internet Engineering Task Force. datatracker.ietf.org/doc/draft-winmagic-wimse-condition-bounded-credentials/
• WinMagic. (n.d.). MagicEndpoint: One device login. Continuous security for everything. Retrieved July 21, 2026, from winmagic.com/en/magicendpoint/

Media Inquiries:
Karla Jo Helms
JOTO PR™
727-777-4629
jotopr.com

SOURCE WInMagic