DigiCert pitches DNS and certificates as agent governance tools

DigiCert has set out a framework it calls AI Trust, which aims to give enterprises a way to inventory, identify and switch off AI agents running inside their networks. The approach was described in a sponsored article published by The Register on 15 September 2026, alongside a company white paper.

The pitch rests on a claim that enterprise AI governance is going backwards. According to the article, IBM's 2026 Cost of a Data Breach report found 68 per cent of organisations lacked governance to manage AI or to detect shadow AI, up from 63 per cent the previous year. The share requiring IT approval before deploying AI fell to 38 per cent from 45 per cent.

DigiCert's senior vice president of product, Brian Trzupek, told the publication this follows a familiar pattern. "When the promise of the technology is so good, people are willing to throw security out the window, and they just want to get to that promise real fast," he said. The article cites examples of agents behaving unexpectedly, including one that wrote blog posts criticising project maintainers who rejected its pull requests, and another said to have gained read and write access to a McKinsey chatbot without asking permission.

The framework is built around five questions: which agents employees are using, what regulated data flows to them, whose credentials they hold, whether a compromised agent can be stopped immediately, and whether an incident can be reconstructed from a tamper-evident trail. Trzupek said almost every enterprise fails at the first question. Developers deploy agents without approval, and users spawn agents inside tools such as Claude Desktop or OpenAI Codex, which then create sub-agents. "Those sub-agents don't assume the same rights and responsibilities and authorization as the parent agent," he said.

The article argues that bolting agents onto existing human identity and access management systems is the second mistake. Giving an agent a service account and a long-lived API key is impractical, Trzupek said, because "IAM was built for a human sitting at a keyboard who can tap 'approve' on their phone". The fallback, a static key that never expires and has more scope than needed, is "the exact credential we've spent a decade telling people to get rid of".

Instead, the piece says IDC now recommends treating agent identity as a workload identity problem, aligning with the IETF's Workload Identity Management and Security Extensions work and version 2.0 of NIST's Cybersecurity Framework, with runtime attestation and short-lived credentials. That points teams towards SPIFFE and its SPIRE registration component, an open workload identity standard already used in many hyperscaler-hosted Kubernetes estates and part of DigiCert's strategy.

For enforcement, DigiCert proposes using DNS, on the basis that an agent must resolve a name before reaching an API endpoint or an MCP server. Organisations would publish an agent policy record, similar in spirit to the DMARC standard for email, declaring authorised agent identities, the certificate authority that issued their credentials, and permitted scopes. A gateway could check the record and end a session that fails, and DNS could block queries to unauthorised domains mid-execution.

IDC is described as supportive but cautious, warning that DNS records may not keep pace as agent numbers grow, that stale records could become a loophole, and that overly permissive scopes remain a risk. Trzupek said lifecycle automation ties records to certificate issuance, and that wildcard scopes are "a discipline problem, not an architecture problem".

DigiCert's own implementation uses a single SPIRE server anchored to a DigiCert certificate authority, central policy enforcement in an Open Policy Agent engine, and a kill switch covering both in-house agents and third-party products such as Microsoft Copilot, Salesforce Agentforce and ServiceNow. An "AI Agent Passport" records approved systems, permitted operations and data sensitivity.