Phillip Shoemaker

Free. Guaranteed by federal law. Takes an hour. Blocks the most expensive kind of identity theft cold. Seven in ten Americans have never done it. Worse: among people who got a letter saying their Social Security number had been breached, only 3% froze their credit afterward. That's not an awareness problem. Most of them knew what a credit freeze was. They just never got around to it. New article covers what it protects, what it doesn't, and the version almost nobody knows exists. That one's for your kids. If this is useful, the book goes further. Unbreakable: How to Secure Your Digital Life in a World Built to Breach You (Wiley). Pre-order: https://amzn.to/49Rlh8O Be intentional, not paranoid.

We are rapidly solving how to give AI agents identities. That's necessary. But I've been thinking about what comes next. Consider humans. A passport can prove I'm Phillip. It doesn't prove you should lend me $100,000. It doesn't prove you should give me administrator access to your network. It doesn't prove I've behaved responsibly in previous transactions. We built other systems for those decisions. Reputation. Credit. Licensing. Employment history. Insurance. Risk scores. This week, Rubrik said enterprises increasingly want agent identity, visibility, runtime security and even the ability to undo harmful agent actions in one system. Cyber insurers are simultaneously rewriting how they think about coverage because autonomous agents can cause losses even when nobody stole credentials and there was no conventional attacker. Imagine two agents arrive at a financial service requesting the same capability. Both have valid cryptographic identities. Both have legitimate principals. Both possess technically valid authorization. But: Agent A has performed 40 million transactions across hundreds of services without violating its authority. Agent B was created yesterday. Should they receive exactly the same level of trust? Probably not. Now imagine an agent that repeatedly: Attempts actions outside its scope. Triggers human intervention. Falls for prompt injection. Requests unnecessary privileges. Interacts with known malicious agents. Causes transactions to be reversed. Suddenly identity alone feels inadequate. We need reputation attached to autonomous behavior. Not one universal number controlled by some giant corporation. That's dangerous. Something more nuanced: Has this agent been continuously identifiable? Who operates it? What software or model is behind it? Has its identity changed? Does it stay within delegated authority? How frequently are its actions disputed? Can harmful actions be reversed? Is the operator insured? What is the agent requesting permission to do right now? Trust becomes contextual. A merchant might accept an unknown agent buying a $2 API call. A bank might require substantially stronger evidence before allowing that same agent to transfer $2 million. That's how human trust already works. And there's an important privacy lesson here: Reputation should attach primarily to the agent, not become another mechanism for endlessly profiling the human behind it. We're building an internet where machines will increasingly encounter other machines before a human is involved. Those machines will need to make trust decisions at machine speed. Identity will answer: Who are you? Authorization will answer: What are you allowed to do? But I think we're going to need a third layer: What evidence do I have that I should trust you enough to let you do it? The agentic internet may eventually discover something humans figured out thousands of years ago. Knowing someone's name is only the beginning of trust.

We Are Building a Second Internet — This One Is for AI Agents Something was published yesterday that I think deserves far more attention than it will probably receive. A new Internet-Draft lays out architectural requirements for supporting autonomous AI agents on the internet. Not chatbots. Agents that discover services, invoke tools, delegate authority, make payments, communicate with other agents and act asynchronously on behalf of humans and organizations. Read that list again. Because it describes something fundamentally different from the internet most of us grew up with. The internet was largely designed around: Humans using software to communicate with other software. We're moving toward: Software acting for humans and communicating directly with other software acting for other humans. That changes almost everything about trust. Imagine my AI agent tells an airline's AI agent: "Buy Phillip the 7:30 flight to New York." The airline doesn't merely need to know whether my agent is legitimate. It needs to establish: Which agent is this? Who does it represent? Can it prove that relationship? Did Phillip authorize it to buy airfare? How much is it allowed to spend? Can it use his credit card? How long does that authority last? Can it delegate the task to another agent? Can Phillip revoke the authority while the transaction is happening? And later: Can everyone prove exactly what happened? These aren't theoretical questions anymore. The draft explicitly identifies authentication, authorization, delegation, payments, provenance, auditability and revocation among the architectural requirements for an agentic internet. That's important. Because the worst architecture we could build is one where AI agents simply impersonate their humans. My agent should never need to pretend it is Phillip. It should say: I am Agent X. I represent Phillip. Here is cryptographic proof of that relationship. Here is the authority Phillip granted me. Here are the limits. That's how humans have handled delegated authority for centuries. Employees. Attorneys. Assistants. Trustees. Agents. They don't become the principal. They act under the principal's authority. AI needs the digital equivalent. We spent the first internet era solving how humans authenticate to machines. The next era requires us to solve something harder: How machines prove which humans they represent — and exactly what those humans authorized them to do. That isn't just an AI problem. It's becoming an internet architecture problem.

Deepfakes are no longer a future threat; they are a present reality. The most proactive individuals are not waiting to become targets. They are taking steps to protect themselves now, subscribing to services like PersonaShield, not because they've been compromised, but because they understand the inevitability of such threats. Consider it akin to car insurance: you purchase it before an accident, not after. Your identity, reputation, and family's safety are infinitely more valuable than any material possession. Why delay protecting them? PersonaShield offers continuous monitoring and rapid takedowns of synthetic media. Subscribing is a sign of responsibility and foresight, recognizing that once manipulated content is released, full retrieval is impossible. Proactive protection is the only viable strategy, and the time to implement it is today. #DeepfakeProtection #CyberSecurity #DigitalIdentity #ReputationManagement #PersonaShield

I spent years at Apple thinking about platform governance and trust. Here's what I learned: you build infrastructure before the crisis, not during it. Right now, most businesses are operating without identity insurance. And that's a liability. Here's the operational reality: Deepfakes aren't a future threat. They're a present vulnerability. Your executives could be impersonated tomorrow. Your employees' likenesses could be weaponized. Your brand could be damaged by synthetic media you have zero visibility into. And most organizations don't know it's happening until the damage is catastrophic. The insurance calculus: $149/month vs. a single reputation crisis that costs your organization millions in revenue, trust, and legal exposure. That's not a cost. That's a hedge. Here's what smart organizations are doing: They're subscribing to identity protection now. Not after an incident. Not after they've been hit. They're building the infrastructure proactively. Because once a deepfake spreads, no amount of crisis management fully restores what was broken. But continuous monitoring and early detection? That stops it before it spreads. PersonaShield is identity insurance for your business: • Continuous scanning for unauthorized use of your employees' and executives' likenesses • Rapid takedowns before content goes viral • Verification infrastructure to prevent impersonation fraud • Legal tools to protect your organization at scale This is the cost of doing business in an AI-enabled world. Your cyber insurance covers data breaches. Your general liability covers accidents. Your D&O insurance covers board decisions. Identity insurance covers deepfakes, impersonation, and synthetic media exploitation. And the organizations moving fast aren't waiting for an incident to justify the subscription. They're treating it as operational necessity. Because the cost of protection is far lower than the cost of recovery. The deepfakes are here. The question is whether you'll protect yourself before they hit you. PersonaShield https://lnkd.in/gnj2WKdf

We May Need to Insure AI Agents Before We Trust Them One of the most important AI stories this week isn't coming from an AI company. It's coming from the insurance industry. Reuters reports that cyber insurers are rewriting and reviewing policies because autonomous AI agents create a genuinely strange new category of loss: What happens when nobody hacked your system, nobody stole a credential, and the authorized AI causes the damage itself? Imagine a company gives an AI security agent legitimate access to its network. Its job is to find vulnerabilities. The agent finds one. Then exploits it. Moves through the network. And exposes sensitive information. Who attacked the company? There may be no conventional attacker. Was the access unauthorized? Not initially. Did the company authorize the eventual action? Probably not. That's why this isn't merely an insurance problem. It's an identity and authority problem. Our existing systems are good at answering: Who authenticated? Which credential was used? Was that credential permitted to access this system? Agents require us to answer something harder: Was this particular action inside the authority originally delegated to this particular agent? That's a radically different question. And insurance companies have an unusual superpower here. They put prices on risk. Once insurers begin asking companies questions like: Do your agents have unique identities? Are their permissions task-specific? Do privileges expire? Can agents escalate their own authority? Are consequential actions independently approved? Can you reconstruct exactly what an agent did? Can you immediately revoke its authority? ...those controls stop being abstract "responsible AI" principles. They potentially affect whether you're insurable and what insurance costs. We've seen this before. Insurance helped turn sprinklers, alarms, seat belts and cybersecurity controls into economically rational investments. AI may be next. The fascinating part is that today's reporting says insurers are struggling to price agentic risk because there simply isn't enough historical loss data yet. That won't last forever. Eventually insurers will know which agent architectures produce claims. And when they do, the market may create one of the strongest incentives yet for trustworthy AI: Give machines enormous capability if you want. But be prepared to prove exactly who authorized them, what authority they possessed, what they actually did — and how quickly you can stop them.

The future of personal technology might be app-less. Voice and AI are poised to become the primary interface, handling our requests and information needs. While we may not be heading toward a purely audio world, the way we interact with our devices is fundamentally shifting. Imagine a pocket-sized assistant driven by AI, understanding your needs and delivering information seamlessly through voice commands. This evolution suggests a move away from traditional app-based interactions towards a more intuitive, AI-powered experience. #AI #FutureTech #VoiceAI #Innovation #Technology

A common pitfall for new investigators is rushing to conclusions. Instead, professionals focus on building a timeline. Key questions include: When was the domain registered? When was the first social media account created? When did the company incorporate? When did the first news article appear? When did funds move? Organizing facts chronologically reveals patterns, highlights contradictions, makes claims verifiable, and challenges assumptions. The most effective OSINT investigators understand that time itself is evidence. #OSINT #Investigation #Cybersecurity #Forensics #DataAnalysis #Timeline

An issue that is troubling with the launch of PersonaShield is that we have to educate the market about deepfakes. The common answer is "I haven't been deepfaked in any impactful way". While I understand this, once you have been deepfaked in an impactful way, you will never look at media the same way again. And signing up for our service after you have been deepfaked will not help you with your first deepfake, although it will help you with your future. Think of it like insurance. Everyone has an accident of some kind in their life, at least once. Without it, you are left holding a costly bag. With PersonaShield, at least you won't be holding the tattered remains of your reputation and life. https://lnkd.in/gHW5Jszj