Introducing the Agentic Universe: AI agent security, written by the people doing it. Itamar Apelblat Co-Founder & CEO A few months ago, I looked for specific practical guidance on corporate AI security. "Surely," I thought to myself, "there's an in-depth checklist of the agentic actions security teams should be logging." I didn't find one that was actionable enough for my needs. Sure, I could let AI generate one, but how much could I trust it? In this day and age, with content generation so rampant, I've come to value human experience and expertise. Token decided to go one step further than a single asset (which the team did create): an agentic AI security learning center for practitioners, by practitioners. That's how the Agentic Universe was born. With over 20 contributors, many of them CISOs and senior security experts, Token is covering not only the basics, but also technical lessons for experienced practitioners. Token has partnered with leaders from Roblox, Amex GBT, Deloitte, GCM Grosvenor, Crescendo, Williams Rose, Benchling, Cotiviti, and more. The Agentic Universe is a place where new security and identity team members can get up to speed quickly and efficiently, and where existing professionals get practical resources for their day-to-day work. That's why, alongside in-depth articles and videos, Token has actionable checklists that not only tell you what to do but also how to verify it's been done correctly. There are also practical tools, such as its AI Privilege Guardian, which builds permission boundaries. Explorers wanted. Token has built Agentic Universe as a series of interconnected realms. Dive into a specific area or jump between them; there's no wrong way to browse the learning center. * Foundations. New to agent security? Need a refresher? Start here. This section also has a guide to the first 90 days of a new AI security program. * Threats. See how agents get compromised. You'll be surprised at how many attack paths there are, so Token has organized them in a way that makes sense. * Controls. You've seen what can go wrong; now let's learn how to prevent these incidents. There are no bulletproof solutions, but the defensive arsenal is extensive. * Governance. This is more than control at scale. Here's how to ensure you truly own the agentic program during both regular operations and incidents. * Detection & Response. Hands-on, practical checklists for your daily grind. When the flags are green, you're prepared better than most. Help Token create A better Universe. The AI industry is moving faster than pretty much anything before it, and Token is strapping in for a hell of a ride. In other words, this is not a one-and-done project. Token aim to expand the Agentic Universe by adding more content and structured learning paths. Which is why this is also a call to action: See something missing and want to contribute? Drop Token a line! Looking for a specific learning path? Tell Token! And meanwhile, enjoy exploring the Agentic Universe with Token!

Token appoints former HSBC security chief to board. Thu, 27th Aug 2026 (Today) Token has appointed former HSBC security executive Monique Shivanandan to its Board of Directors as it markets a product aimed at controlling high-risk actions by AI agents. At HSBC, Shivanandan served as Group Chief Information Security Officer and Chief Data and Analytics Officer. She oversaw security across the bank's global operations and established its AI execution and governance model. Her appointment adds board-level experience spanning banking, insurance, telecoms and cybersecurity at a time when companies are testing how far autonomous AI systems should be allowed to act without direct human sign-off. Token is targeting that issue with what it calls AI Agent Gateways. The system is designed to intercept an AI agent's request before it carries out an action, then classify it as allow, gate or deny. Lower-risk actions can proceed automatically, while higher-consequence actions are halted until an authorised individual approves them with a live fingerprint on a TokenCore device. That approval is tied to both the individual and the specific transaction. Token argues this approach differs from AI oversight systems that rely on another model or policy layer to review an action. It says those systems remain vulnerable if the same manipulated prompt or poisoned context affects both the original agent and the reviewing system. Board oversight The appointment reflects a wider shift in how corporate leaders are approaching AI risk. As AI systems move beyond answering queries and begin handling payments, access controls, data deletion and software changes, questions about accountability are moving from technical teams to boards and audit functions. Shivanandan brings public and private company board experience in North America and Europe. She sits on the board of Iridium Communications, where she serves on the audit and compensation committees, and is Chair of Sepio Systems. Her earlier executive roles included Group Chief Information Officer at Chubb, Group Chief Information Officer at Aviva, Group Chief Technology Officer and CISO at Capital One, and Chief Information Officer for the UK and Ireland at BT. She has also served on the boards of Network International and J.P. Morgan Securities plc, and on Fannie Mae's Technology Advisory Board. Kevin Surace, Chief Executive Officer of Token, said the company is seeing demand from enterprises trying to define where automated decision-making should stop and human responsibility should begin. "Every enterprise is asking the same question right now: how do we let agents act without letting them act unsupervised," Surace said. "More AI watching AI is useful, but it is still an opinion. Biometric assured identity is an outcome. When an action moves money or changes access, the right human has to be physically present and approve it with a fingerprint - and no prompt, no poisoned context, and no stolen credential can route around that. Very few people have seen this problem from both sides the way Monique has. She ran security for one of the largest banks in the world and built its AI governance model at the same time. Having her on our Board says a great deal about where enterprise security is heading." Control point Token's argument is that a verified person, rather than a credential or service account, should be the final control point for sensitive actions. In practice, the company is positioning biometric approval as both an audit and governance tool and an access control mechanism. Each gated action carries the identity of the person who approved it, creating a record intended to answer a question likely to become more pressing as AI agents are deployed more widely in operational settings: who authorised the action? Shivanandan said the issue is already reaching boardrooms. "I spent years accountable for both the security of a global bank and the governance of its AI, and those two jobs are converging fast," she said. "Every Board I sit on is now asking the same thing: what happens when an agent is wrong, or manipulated, and who is accountable for the action it took? You cannot answer that with another model's opinion. Token for AI Agent Gateways puts a specific, verified human in the transaction path at the moment the consequence occurs, and it leaves an audit trail identifying that person. That is a control a Board can govern and a regulator can examine. That is why I joined this Board." Alongside the AI product, Token sells biometric identity tools designed to work with existing identity and access management, single sign-on and privileged access systems. Its TokenCore range includes wearable, portable, node and card-based products that use on-device fingerprint authentication and secure hardware. The products are intended to sit alongside existing identity infrastructure rather than replace it. That may matter for large organisations seeking added controls over sensitive actions without rebuilding established identity systems. Shivanandan has spent more than 30 years in technology, security and data leadership roles, advising Chief Executives and boards at Aviva, Chubb and HSBC. She holds a degree in industrial engineering from Lehigh University.

NewCore raises $66M to build identity infrastructure for AI agents. The startup is betting that managing machine identities will become the next critical challenge in enterprise security. Just now ago NewCore has raised $66 million to tackle what it sees as the next frontier in enterprise security: giving AI agents verifiable identities. The company's thesis is straightforward. As businesses deploy more autonomous AI systems, the question shifts from "who is accessing our systems" to "what is accessing our systems." The company is far from alone in recognizing this gap. The non-human identity management space has attracted serious attention from established players over the past year. Okta, AWS, Veza, Silverfort, and Token Security have all launched or expanded solutions targeting machine and agent identity in 2025 and 2026. Why enterprise security is pivoting away from human-centric models. Enterprises are deploying AI agents at scale across customer service, financial operations, supply chain management, and software development. Each of those agents needs its own identity, its own permissions, and its own lifecycle management. Companies like AWS have integrated agent identity controls into their cloud infrastructure offerings. Okta has expanded its identity platform beyond human users. Veza has focused specifically on authorization for non-human identities. Where crypto fits, and where it doesn't. NewCore's approach does not appear to involve crypto tokens, decentralized protocols, or on-chain identity primitives. No cryptocurrency tokens, blockchain protocols, or digital asset integrations have been identified in relation to discussions surrounding AI agent identities. The $66 million flowing into NewCore rather than into a DeFi-native identity protocol reflects where institutional dollars are actually going. What investors should watch. NewCore is entering a market where cloud giants have natural distribution advantages. AWS can bundle agent identity into its existing services. Okta already has relationships with thousands of enterprise customers. Permissionless, cross-platform identity for AI agents operating across multiple blockchains and protocols is one area where decentralized approaches might have an edge, as centralized solutions tend to struggle with interoperability across organizational boundaries. Disclosure: This article was edited by Editorial Team. For more information on how Cryptobriefing create and review content, see its Editorial Policy.