Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
UK Whistleblowers Raise Security Concerns Over One Login Digital ID Infrastructure
Whistleblowers with direct knowledge of the UK government’s GOV.UK One Login programme have raised serious concerns about security controls underpinning the system, according to reporting by ITV News. One Login supports access to services used by an estimated 13 million people and is expected to form the foundation of the government’s planned Digital Wallet initiative. Leaked assessments cited by ITV describe high-risk findings, including alleged failures to meet Secure by Design and Cyber Assessment Framework standards, with potential consequences ranging from large-scale identity fraud to exposure of sensitive individuals. The government has said the programme works closely with the National Cyber Security Centre and that vulnerabilities identified through testing are addressed.
Visa Reports Early Progress on Agent-Initiated Transactions and Trusted Agent Protocol
Visa says it has completed hundreds of secure agent-initiated transactions with partners as part of its Intelligent Commerce initiative, positioning 2026 as a key milestone for AI-driven purchasing. The company reports that dozens of partners are already building or integrating within its sandbox, spanning consumer retail and B2B use cases. Central to the effort is Visa’s Trusted Agent Protocol, an open framework designed to distinguish authorized AI agents from malicious automation without disrupting existing merchant infrastructure. Partners including Akamai are supporting the protocol, framing agentic commerce as a dual-identity challenge that requires verification of both the agent and the consumer it represents.
Socure Joins World Economic Forum Unicorn Community Ahead of Davos 2026
Socure has joined the World Economic Forum’s Unicorn Community and confirmed that CEO Johnny Ayers will attend the 2026 Annual Meeting in Davos-Klosters. The company says its engagement will focus on trusted identity in the context of AI agents, cross-border financial systems, and large-scale fraud. Socure cited its global footprint, serving thousands of customers across nearly 200 countries and processing billions of identity verification requests annually, as positioning it to contribute to policy and industry discussions. The 2026 Davos meeting will convene under the theme “A Spirit of Dialogue,” with emphasis on collaboration across governments, industry, and civil society.
Brussels Declaration Explicitly References EU Digital Identity Wallet
The Brussels Declaration issued after the EU–Western Balkans summit explicitly references the EU Digital Identity Wallet, placing it among digital initiatives that partner countries are encouraged to adopt or mirror. Published by the Council of the European Union, the declaration frames digital identity alongside connectivity and data mobility as part of gradual integration into the EU single market. While the document does not impose requirements or provide technical detail, the inclusion of the wallet signals its positioning as a model for regional digital public infrastructure. The reference suggests digital identity is becoming a formal component of the EU’s external digital engagement strategy.
SailPoint and CrowdStrike Announce Identity-Centric Security Integrations
SailPoint and CrowdStrike have announced new integrations connecting SailPoint Identity Security Cloud with the CrowdStrike Falcon platform. The companies say the integrations are designed to bring identity governance context into security operations workflows, enabling correlation of identity risk with active threats. Shared data and automated actions allow identity risk signals to inform SIEM and SOAR processes, while Falcon Fusion workflows can trigger remediation actions in SailPoint. The announcement reflects a broader push to treat identity as a core control plane across people, devices, and increasingly AI-driven actors.
AWS Details Sophisticated Campaign Using Compromised IAM Credentials
Amazon Web Services has disclosed details of an ongoing cryptomining campaign targeting EC2 and ECS environments using compromised IAM credentials. AWS emphasized that the activity did not exploit a vulnerability in AWS services, but relied on valid credentials obtained by unauthorized actors. The campaign involved rapid enumeration of permissions, deployment of miners across EC2 and ECS, and techniques designed to hinder response, including disabling API termination and creating publicly accessible Lambda function URLs. AWS published indicators of compromise and mitigation guidance, underscoring the importance of least-privilege IAM policies, temporary credentials, and multi-factor authentication.
India Advances Agri Stack With Unique Digital Identity for Farmers
India is moving forward with Agri Stack, a digital infrastructure initiative that will assign a unique digital identity to each farmer, according to reporting from The Tribune. Developed under the Digital Agriculture Mission, the system is described as linking farmer identities with land and crop records to support benefits delivery, credit decisions, insurance claims, and market access. The initiative reflects the expansion of digital identity beyond citizen services into sector-specific infrastructure that connects identities with registries and entitlements. While technical and privacy details remain limited in public reporting, Agri Stack highlights the growing role of identity systems in public-sector service delivery.
OpenID Foundation to Launch Conformance Testing for Global Verifiable Credential Standards
The OpenID Foundation has announced it will open self-certification through its conformance testing platform on February 26, 2026, covering OpenID4VP 1.0, OpenID4VCI 1.0, and the High Assurance Interoperability Profile 1.0. The foundation says the move is intended to support interoperability across wallets, issuers, and verifiers in dozens of jurisdictions. Free, open-source conformance tests are already available and can be run locally or against OpenID-hosted servers, with many teams integrating them into CI pipelines. The foundation has positioned self-certification as a first step, with additional accreditation services planned for later in 2026.
—
By the ID Tech Editorial Team