Keyfactor has announced its intent to acquire Cofide, a UK-based identity platform that issues verified identities to software workloads and AI agents running across cloud environments.
Cofide’s approach limits agent authority by giving each workload and AI agent its own verified identity that is unique and short-lived, replacing static secrets with cryptographic proof of what a workload is. The problem it targets is that automated systems inside enterprise environments now far outnumber employees, while most are still secured with static credentials that can be copied or stolen, handing whoever holds them the same access as the system itself. The platform is built on open standards including SPIFFE, OAuth, and OIDC, and unifies workload identity and access management across multiple cloud platforms. Folding it into the Keyfactor Trust Control Plane is intended to give security teams a single system for governing non-human identities alongside the certificates and keys they already manage.
Financial terms were not disclosed. Cofide’s team and technology join Keyfactor immediately.
“As AI agents, machine identities, and autonomous workloads become critical to business operations, trust infrastructure must evolve to keep pace,” said Jordan Rackie, chief executive officer of Keyfactor, adding that the deal extends trusted identity beyond traditional systems so customers can manage “the next generation of digital actors” with existing levels of confidence.
Gün Akkor, Keyfactor’s chief product and technology officer, framed the problem as operational rather than technical. “Customers stall on securing their workloads because it is operationally hard, not because the technology falls short,” he said. Matthew Bates, Cofide’s founder and chief executive, said the company built an open standards-based trust layer to cut that complexity, and that “AI agents are proliferating faster than most organizations can secure them.”
Vendors across the identity stack have spent the year working on what an autonomous agent should be allowed to do and how its actions get attributed, with a wave of new tooling from CrowdStrike, SailPoint, Beyond Identity, Akamai and Saviynt, while standards bodies have begun to weigh in through work such as NIST’s concept paper on AI agent identity and authorization.
Keyfactor raised more than one billion dollars for machine identity and post-quantum trust earlier this month. The company sells certificate and key management to enterprises and government agencies, issuing cryptographic identities to machines, workloads and AI systems.
Sources: Keyfactor
–
By Ji-seo Kim
