AI agents are already on your site, Vouched says, introducing KYA tool to prove it

Vouched has quietly brought its know your agent (KYA) software to market to detect AI agents online, anywhere from websites or banking platforms to fintech apps.

AgentShield is a free KYA tool, integrated in a range of ways, including as a marketing pixel or a comprehensive server-side middleware for more granular control. Businesses can implement the software within minutes, the company says.

Vouched Growth Lead for Know Your Agent Corey Breier tells Biometric Update in an interview that four questions must be answered for secure interactions with agents. Businesses need to be able to identify the agent, authenticate the human it is acting on behalf of, what the human has authorized to do, and when the agent is authorized to carry out the instruction.

The ability to give an AI agent login credentials, credit card information and instructions on what flight to book and then send it off to a travel booking website to complete the transaction is exciting for consumers. But Breier points out that it is equally “scary for the vendors, because how do they know that that agent was actually told by you to do that thing?  How do they know that that agent has your credit card with your permission? There are several layers of confirmation that you need to have that resembles KYC.”

This is where biometrics come in, to verify the identity of the person behind the AI agent.

Vouched announced in September it has raised $17 million, largely to tackle agent verification, as CEO Peter Horadan and Misha Polovneff of BHG Financial explained to The Biometric Update Podcast.

Many businesses are already interacting with AI agents without even being aware of it, Breier says.

“Agents are already on your site, already taking actions on behalf of users. And you don’t know which agents they are or whether the users gave them that access. It’s a very scary fact, but it is a true fact, and its one we’ve seen play out with all of our AgentShield customers.”

To help detect those agents, Vouched built an identity protocol for the Model Context Protocol (MCP), which has emerged as the industry standard to allow AI to interface safely with websites. “It’s great and it works,” Breier says, “but it doesn’t have an identity component to it, so it opens the door to all of these problems.”

Hence Vouched’s introduction of the Model Context Protocol – Identity (MCP-I) Specification.

“It assigns an identity to each agent that is verifiable cryptographically, such that it is not us saying ‘Vouched says this agent is who it says it is, and you can trust Vouched.’ It’s us saying ‘here a cryptographic identity card for this agent that you can verify on your own,’” Breier explains.

This allows decentralized agent verification. The biometric verification that binds the human to the bot proceeds in the same way already familiar to Vouched customers.

The company already has several customers with AgentShield in production, and plans to share a case study once it has gathered data on how many agents they have found from them.

Ecommerce and travel are the first industries seeing regular traffic from AI agents, according to Breier, prompting interest from those kinds of businesses. The news media industry is also finding AI trawling its websites, he says, and information security professionals, product managers, trust and safety managers and data analytics operations are all interested in knowing how many AI agents they are interacting with.

Breier does not expect a long adoption curve. He suggests that unfortunately, a headline-grabbing fraud or cybersecurity incident involving an AI agent will likely “make the news, and then everyone will be scrambling.”

Vouched is moving fast to establish the effectiveness of its KYA technology before this happens.

The company sees consumers adopting AI agents more quickly than businesses, though Breier says both use cases are coming.

The average consumer is for more likely to be interested in buying a product from Walmart based on an agentic analysis of the one with the best reviews then they are to be familiar with the ID verification and trust implications. That makes the user experience part of agent verification important.

“If we can make the identity parts of this easy, then everything else is very straightforward,” Breier says.

Vouched has also launched an agent identification database, KnowThat.ai, as another pillar in its strategy to help businesses know which AI agents they can trust.

Capabilities for requiring agent verification and cryptographic security thresholds are coming soon, Vouched says.

Article Topics

AgentShield  |  AI agents  |  biometric authentication  |  cybersecurity  |  identity access management (IAM)  |  Know Your Agent  |  KYA  |  Vouched