Autonomous Intelligence and the Future of Digital Trust - Amit Sinha

Absolutely, Josh. First, it's a pleasure to be back. Really enjoyed our conversation. DigiCert, we're the global leader in intelligent trust. Our solutions are used by over 100,000 organizations, including about 90 plus percent of Fortune 500, to get security, authenticity, and encryption for all the digital interactions. Our core platform is called DigiCert One, and it brings together PKI, DNS, and certificate lifecycle management to secure infrastructure, software, devices, content, and now AI agents.

It's new. DigiCert One's new. It brings together PKI, DNS, and certificate lifecycle management to secure infrastructure, software, devices, content, and now AI agents.

Yes.

Yeah. So Josh, we've gone from the point where CLMs were nice to have to now it's absolutely essential. I was talking to a CISO of a bank and he privately said, 'Hey, we have three certificate related outages a day.' And that is with a one-year cert. Now imagine one year goes to 47 days, you have 8x more certificate volumes being issued, so you're going to have like an outage an hour. So without automation, it's costly. You lack resilience. So you got to fix all of that now.

Without automation, and a bank, without automation, it's costly. You lack resilience. So you got to fix all of that now.

Correct.

Yeah. So with certificate lifecycle management, step one, you have to understand that there are 100 times more machine identities in an organization than humans, right? So without having an inventory of all your cryptographic assets, you don't even know where to start. So that's step one. With DigiCert One, you're able to get a full inventory of all your assets. But then what is more important is how do I automate the full lifecycle from issuance to last mile installation across my entire digital footprint? Think about all user laptops, all machines, cloud workloads, your CI/CD pipelines, your documents, OT. PKI just touches everything. And unless you have a proper solution that can give you full automation across all of these assets, you'll continue to have these outages or expenses. And we recently did a study with Forrester Research and found that our top organizations that have deployed DigiCert One with full automation were able to get their money back from the investment that they made in DigiCert in 6 months.

6 months is the payback period. And in fact, most of these large organizations ended up saving close to $3 million just by automating.

Yes, it's on the website. It's the Forrester Total Economic Impact report with DigiCert.

Yeah, 100%. Look, in the PKI world, we know how to secure machines and workloads. We can use DNS to give them a name. We can drop an X.509 cert and give them an immutable identity. And that's how it establishes the trust fabric within an organization. What is an AI agent? An AI agent is a smart workload. We strongly believe that all agents within an organization should have durable, immutable cryptographic identity. I call them digital passports. So Josh, if you come to work for DigiCert, the first thing we'd say is, 'Hey, prove to me that you're Josh. Show me your driver's license.' And we want to bring the same concept to AI agents. Next year maybe I'll have six AI agents working for me. But I have to know that those six are mine. I need to have an audit trail. I need to have a kill switch. If I don't want some agent, I need to be able to revoke it. And before I give these agents access to my enterprise kingdom, they better come with strong immutable cryptographic identities. This is a solved problem with SPIFFE, SPIRE, PKI. We've solved this with dynamic workloads. And what DigiCert One is doing now is extending those PKI-based mechanisms to agents to give them identity, which is step one for any zero trust implementation.

Correct. And we've solved this problem, Josh. Look, workloads, when I was at Zscaler, for example, you couldn't have a workload without a DNS entry, and that became like a registry of all my workloads. And then those workloads when they needed cryptographic identities and secure connections, you can issue the certificate tied to that internal name. So it's a solved problem. And what we're doing is we're bringing digital passports to AI agents using PKI, SPIFFE, SPIRE, OPA-based policies. And I think that's the step.

Yeah. And so that's on the agent side, but AI is also introducing this whole problem of what's real, what's fake. Look at content. You guys will release this video, someone can download it, use Google Nano Banana Pro and change something. Where is the content provenance? Again, solved problem with PKI. You can sign a PDF document and we know this is tamper-proof. Here's all the metadata. So with DigiCert One, I can digitally sign my documents, my videos, my everything. And if anybody does a deep fake of it, it's not going to stop them from deep faking it, but I can attest original content provenance. So the original content has the provenance, so I can prove this is real. And I think we'll live in a world where you might have a blockchain of all trusted media providers. On LinkedIn, for example, you see now little CR tags that show up with media which has cryptographically signed content record. But there's all kinds of things. We have insurance companies coming to us and saying, 'Hey, we're getting fake accident reports.' We have camera manufacturers saying, 'I want to sign the metadata, GPS coordinates, timestamps, etc. of my image and raw files, because I want to be able to prove this originally came from this camera at this time in this place.' It's crypto. We digital fingerprinted it and cryptographically signed it. And then that picture, if it's this picture you're seeing with this cryptography attached to it, it's real. And the standard that we've been working with a lot of the media providers, Microsoft, Adobe, etc., is called C2PA, Content Provenance Initiative. DigiCert is a certified certificate authority for that, and we've also been accepted into the product conformance list to be able to sign these types of media using C2PA.

This is fascinating. You've really... So did this start with you at DigiCert? You came to DigiCert a few years ago? Did this expansion of DigiCert's traditional PKI roots into 'there's so much more we can do with this' start with you?

Yeah. So I think the pivot that we made as a company after I joined about 3 years ago was we were a very reputed certificate authority, huge one. And now what we do is we say it's a full soup to nuts solution where we manage... we still are the best CA out there, and the ability to manage your public TLS, private PKI, replacing your internal CAs, your legacy CAs, and being able to provide a full lifecycle management around everything that PKI touches across your infrastructure, your workloads, your machines, your software, your content. So it is the whole platform that is automating PKI and DNS for you.

Yes. So we did acquire a company called UltraDNS and... Well, I know you bought UltraDNS. Yeah. So UltraDNS serves about one-third of the authoritative queries in the world, used by some of the biggest e-commerce engines and software companies. And the reason why PKI and DNS working together is so important is because as these certificate lifetimes are shrinking, you need to do the domain control validation through DNS more frequently. So if you have a fragmented solution, what happens is your PKI says, 'I need to check DNS, here's a secret, the DNS check the text fields or whatever.' The DNS doesn't respond, or worse still, the PKI and DNS teams are siloed, and the DNS team says, 'No, you can't add this record,' and automation fails. For failsafe automation, you need PKI and DNS working in a tight loop to be able to say, 'Hey, this cert on this machine is going to expire, we've already pre-authorized the DCV checks, and as soon as it expires, we have issued and installed and we've notified you,' as opposed to back in the day, tickets being opened, people running around, and that's where all the inefficiency and resiliency failures happen.

So we did acquire a company called ValiMail. That's the leading provider. You bought ValiMail? Yes, we did. Last year? I didn't even hear about that. So look, DigiCert was always issuing verified mark certificates. I've been recommending ValiMail for years. Yes. So we love the solution because now it's a good solution when it comes to messaging trust, email trust. What are the two steps? You need to be DMARC compliant, and that's really tough alignment. You need the SPF, DKIM, and ValiMail is the leading provider of DMARC enforcement. With ValiMail, you're able to enforce DMARC, and with the DNS you're going to be able to do the SPF flattening. They have patents on these dynamic SPF records that are able to deal with the limitations of only so many DNS lookups. I have clients I have to call. This is great stuff. But here's the kicker. You do the DMARC, and then with DigiCert as the issuing authority for VMC and BIMI certificates, once you have DMARC, we can give you those marks, and you get Gmail gives you the blue check mark, your emails get placed prominently, higher opening rates. It's a beautiful solution.

Thank you, Josh.