New researchNobody has counted the machines. We traced every published ratio to its source.Read Field Note 12Read
ARKION
ScanDemo

until public certificates are capped at 100 daysSource

Govern the sprawl of non-human identities at machine speed.

Identity Infrastructure for an Autonomous World.

Machine identities used to last years. Now they last minutes.

Public certificates will be capped at 47 days by 2029. AgentID gives each AI agent you govern an ID that lasts 10 minutes. Arkion issues, tracks and revokes both, from one console.

Built by the team behind Difenda’s exit

Maximum lifetime of a public certificate
Illustration. Public certificate limits set by the CA/Browser Forum. The 10-minute ID is AgentID’s.
§ 01 · The problem

Your machine identities outnumber your people. By one estimate, more than 80 to 1.

Your identity program was built for people: hired in HR, signed in through Okta, removed when they leave. The certificates and credentials your machines use rarely pass through that process, so renewing and retiring them is often left to whoever created them.

80:1
Machine identities per person · CyberArk 2025 survey estimateWhere this number comes from: Field Note 12
§ 02 · What every AI agent brings

Every AI agent you deploy brings new identities with it.

An agent needs credentials to do its job: a service account, API keys, a certificate to prove who it is. New agents go live in minutes, and each one's credentials have to be issued, renewed and revoked on time. A ticket queue can't keep up.

Illustration
  1. AI agentDeployed todayNo ID of its own
  2. Service accountThe account it runs asExpires Never
  3. API keyTo call a model or toolExpires Never
  4. CertificateIssued by your CAExpires In 1 year
That is one agent. Now count every agent your teams deploy.
§ 03 · The platform
The core · ArkionID

Certificate lifecycle management, rebuilt for machines that act on their own.

ArkionID issues, tracks and revokes certificates from its own certificate authority (CA), DigiCert or AWS Private CA. Its own CAs can already sign with quantum-safe ML-DSA and SLH-DSA.

One core, built up
  1. The coreLive
    ArkionID

    Manages certificates from issue to revocation.

  2. Built on ArkionIDLive
    AgentID

    Gives each AI agent you govern its own short-lived ID.

  3. NextIn development
    MachineID

    Will do the same for drones, robots and vehicles.

Up close · AgentID

Every AI agent gets its own NHID™, an ID that expires in 10 minutes.

NHID stands for non-human ID. What a passport is to a person, an NHID is to an AI agent.

AGT-0042
Coding agent
ID valid
Issued by
AgentID on ArkionID
Lifetime
10 minutes
Expires in
10:00
Each action, checked before it runs
Open a pull request✓ Allowed
Try it: one step stops this agent.

Illustration · AGT-0042 is an example agent

How it works today
  1. 01

    Find it

    Scanners find the AI agents you run on AWS Bedrock, Google Vertex AI, Azure AI Foundry, OpenAI, Anthropic and LangGraph, and list them in one inventory.

  2. 02

    Give it an ID

    An administrator registers the agent and issues its ID. The ID lasts 10 minutes.

  3. 03

    Check every action

    Agent calls go through the AI Gateway, beside your agents or regional, in your cluster or hosted by Arkion. Before each action runs, the gateway checks the ID: still valid, not revoked, allowed to do this? If not, the action is refused.

  4. 04

    Stop it

    Revoke one agent’s ID in one step. To revoke every agent ID at once, two different PKI administrators must approve the tenant kill switch.

Works with

Finds AI agents in: AWS Bedrock · Google Vertex AI · Azure AI Foundry · OpenAI · Anthropic · LangGraphIssues certificates from: DigiCert · AWS Private CA

§ 04 · See the product

Your certificates and AI agents, in one place.

A real screen, not a mock-up. This screen lists the authorities that issue your certificates: Arkion’s own, DigiCert and AWS Private CA, side by side. ArkionID tracks your certificates and issues them from any of these. AgentID, built on it, gives each AI agent its own identity and checks what it does.

The Arkion console in a test environment, on the ArkionID Certificate Authorities screen. The menu lists AI Gateway, AI Agents, AI Agent Workflows and Realms, then Certificates and Trust Stores. Cards count 90 certificate authorities from 3 providers and 6 signing algorithms, including ML-DSA-87 and SLH-DSA. The table lists root certificate authorities from SPIFFE, DigiCert and AWS Private CA.
  1. AI agents (AgentID) and certificates (ArkionID), in one menu
  2. Certificate authorities from DigiCert and AWS Private CA
  3. Quantum-safe signing with ML-DSA and SLH-DSA
A real ArkionID screen from Arkion’s test environment, with some names blurred. The counts are test data. Managed Systems (automatic installation on servers) is coming soon.

Today and next

Today, every AI agent you govern with AgentID carries its own ID: valid for ten minutes, checked at the gateway before every action, revoked on command. Next, MachineID will do the same for drones, robots and autonomous vehicles.

§ 05 · Beside your IAM

Your IAM manages people. ArkionID manages machine identities.

We sit beside Okta or Microsoft Entra ID, not in place of it.

  • Sign in employees

    Your IAM
    Its core job: passwords, MFA and single sign-on.
    ArkionID + AgentID
    Not our job. We work beside it.

  • Issue and revoke certificates

    ArkionID

    Imported or issued, every certificate sits in one inventory. Expired ones are flagged.

  • Quantum-safe certificates

    ArkionID

    Can be signed with ML-DSA or SLH-DSA, NIST's post-quantum signature standards, alongside RSA and ECDSA.

  • Find AI agents

    AgentID

    Six agent platforms scanned today, listed in one inventory.

  • 10-minute agent IDs

    AgentID

    One ID per registered agent, valid for 10 minutes.

  • Check each action at the gateway

    AgentID

    Refused if the agent's ID has expired, been revoked or doesn't allow it.

§ 06 · What we believe

What we believe
about machine identity.

01

Machines need IDs that expire.

A certificate proves who a machine is, expires on schedule and can be cancelled in one step. That is why ArkionID, our certificate platform, is our core.

02

Check every action, not just the login.

A valid ID can still try something it shouldn't. AgentID's gateway checks each action before it runs. Stopping every agent at once takes two different admins.

03
Planned

Every agent should answer to a person.

AgentID will link each agent to a named person in Okta or Microsoft Entra ID, so when that person leaves, all of their agents will be suspended at once.

Read Field Note 10
04
In development

One core for every machine.

An AI agent, a drone and a robot should prove who they are the same way. That is why MachineID will be built on ArkionID.

§ 07 · From the research desk

The latest Field Notes.

All Field Notes
§ 08 · Book a Demo

See it on AI agents like yours.

A senior Arkion engineer walks you through both products. ArkionID lists your certificates in one inventory, then issues and revokes them. AgentID gives an AI agent a 10-minute ID and checks each action before it runs.

  • Run by a senior engineer
  • No deck, no sales script
  • Your questions answered live