●

· ·

From Recognition to Proof: How Trust Is Being Re-Engineered for Machine Speed

The word "trust" with the subtitle "From recognition to proof"

This essay expands on the keynote I gave at the Barcelona Cybersecurity Congress in November 2026, “Defending at Machine Speed.”

Trust is usually discussed as a sentiment. In security it is better treated as a decision made under uncertainty: one party accepts vulnerability to another on the basis of some evidence. Mayer, Davis and Schoorman’s widely used model (1995) defines it in roughly those terms. Luhmann (1979) adds that trust exists to reduce complexity, letting us act without verifying everything.

My argument in Barcelona was that the evidence supporting that decision has passed through three regimes: recognition, estimation and proof. Each emerged because the previous one stopped scaling. They loosely track Zucker’s (1986) typology of trust grounded in characteristics, in process and in institutions.

1. Recognition: when perceptual evidence loses its cost

For most of history, identity was established by perception: a face, a voice, a signature. Signaling theory (Spence, 1973) explains why that worked. A signal is credible when it is expensive to fake.

Generative AI has collapsed that cost. The reference case is the 2024 Arup fraud, in which a finance employee in Hong Kong sent roughly $25.6 million across 15 transactions after a video call where the chief financial officer and every other colleague on screen were fabricated (CNN, 2024).

The technical lesson is narrow but important. Human perception is no longer a valid authentication factor for high-value actions. Controls have to move to evidence that stays costly to forge: cryptographic possession factors such as passkeys, and out-of-band confirmation on an independent channel.

2. Estimation: trust as a probability

The second regime replaces recognition with calculation. Rather than asking “do I know this party?”, a system asks “given everything observable, how likely is this action to be legitimate?” Payment networks have operated this way for decades. Zero Trust architecture (NIST SP 800-207) generalizes it: no implicit trust, continuous evaluation.

Vulnerability management shows both the power and the limits of this regime.

The base rate problem

Disclosure volume reached a record 48,185 CVEs in 2025, while the share actively exploited in a given year has held under 1% (Trend Micro, 2026). Over a longer horizon, FIRST’s EPSS data puts the proportion ever observed being exploited at roughly 5%. Severity scoring (CVSS) measures potential impact, not likelihood. That is why prioritization is shifting toward probability (EPSS), observed exploitation (CISA KEV) and stakeholder-specific decision models (SSVC).

CosmicSting as a case study

CVE-2024-34102, known as CosmicSting, is an unauthenticated XML external entity flaw in Adobe Commerce and Magento carrying a 9.8 critical score. Adobe shipped the fix in June 2024, and CISA listed the flaw as known-exploited on July 17, 2024. By August, attackers were pairing it with CNEXT, a glibc iconv bug, to reach remote code execution. That autumn, researchers reported roughly 5% of all Adobe Commerce and Magento stores compromised (The Hacker News, 2024).

The uncomfortable finding is that every public signal was present, and exploitation still ran for months. In Barcelona I shared the downstream numbers: more than 58,000 payment cards potentially exposed and more than 2,600 merchants found infected. The gap was not information. It was the translation of information into prioritized action.

That is the case for intelligence-led prioritization, which I summarized on stage as: prioritization starts where attacker intent meets business exposure. Intent comes from threat intelligence, which is the role Recorded Future plays in our work. Exposure includes transitive dependencies, since risk propagates through a supplier graph rather than stopping at an organizational boundary. That is the problem RiskRecon addresses.

The limits of the number

A score is probabilistic, often opaque, and bounded by what its owner can observe. No single institution observes enough, which makes information sharing a requirement of the model rather than a courtesy.

3. Proof: delegation and the intent gap

Agentic AI introduces a problem the first two regimes cannot solve.

When a person taps a card, authentication and intent coincide. When an agent transacts on instructions given hours earlier, they separate. This is the classic principal–agent problem (Jensen & Meckling, 1976), and agency law has long distinguished actual from apparent authority. Security engineers will recognize the confused deputy (Hardy, 1988): a program with legitimate authority induced to misuse it. Indirect prompt injection (Greshake et al., 2023) is the modern instance, where instructions embedded in content redirect an agent.

Authentication binds the agent to the principal. It does not bind the action to the mandate. A score cannot close that gap either, because the question is not “is this probably legitimate?” but “was this authorized?” That is a question of evidence, not likelihood.

European payments law already contains the seed of the answer. Under PSD2, strong customer authentication must be dynamically linked to a specific amount and payee. Verifiable Intent extends that principle from a single transaction to a delegated mandate.

How it works

Mastercard and Google released the Verifiable Intent specification as open source on March 5, 2026. Its core is a layered SD-JWT credential forming a delegation chain from credential provider to user to agent, with each layer bound to the next through key confirmation claims (RFC 7800). Eight machine-verifiable constraint types are defined, and they travel inside the credential, so an agent exceeding its mandate creates a cryptographically detectable violation. Two modes exist: immediate, carrying final checkout and payment values, and autonomous, carrying constraints the agent must stay within.

Two design choices deserve attention. Selective disclosure implements data minimization structurally, since each party sees only the claims it needs. And the design relies on established standards (SD-JWT, JWS, JWK) with no novel cryptography, drawing on FIDO Alliance, EMVCo, IETF and W3C work.

What proof does not solve

Intellectual honesty requires naming the limits. The specification is still a version 0.1 draft. Proof of authorization is not proof of good judgment: an agent can stay inside its bounds and still choose poorly. Translating natural-language intent into machine constraints is lossy. And the scheme’s assurance rests on key custody at the user’s device.

Implications

  1. Treat trust as continuous, not as a gate. Evaluate the action, not just the login.
  2. Prioritize by intent and exposure, including transitive exposure. Severity alone neither ranks nor mobilizes.
  3. Require evidence of mandate before delegating authority to machines. Non-repudiation has to cover what was asked, not only who asked.

Each regime adds to the last rather than replacing it. We used to trust what we could see. Then we learned to trust what we could measure. In the age of AI, we will only trust what we can prove.

The open research question is the one I would put to readers: what is the equivalent of verifiable intent outside payments, where an agent’s mandate cannot be reduced to an amount and a merchant?

References

The views expressed here are my own.

About the author

Bryan Lopez is SVP, Global Field CISO, Commercial Cybersecurity at Mastercard. He previously led AI, cloud, and cybersecurity strategy for the U.S. Department of Energy and national laboratories at Microsoft, and held cybersecurity leadership roles at Sandia National Laboratories and the Air Force Research Laboratory. He holds a Master of Legal Studies in cybersecurity law and policy from Texas A&M School of Law and is CISSP and CISM certified. Connect on LinkedIn.