The biggest lesson from 2025’s cybersecurity landscape wasn’t a new exploit or a novel piece of malware — it was a sobering pattern. Attackers stole passwords, bypassed phishable MFA, and manipulated users through social engineering, and they did it at scale. As enterprises and government organizations head into 2026 still relying on authentication methods that attackers already know how to beat, Kevin Surace, Chair of TokenCore, says the industry needs to stop patching a broken model and start eliminating the transferable trust that makes these attacks possible in the first place.
TokenCore announced its fingerprint-based identity assurance platform, a solution designed to layer on top of existing IAM, SSO, and PAM systems without requiring a full infrastructure overhaul. By tying access to a cryptographically verified, physically present user, the platform removes the categories of secrets and approvals that attackers depend on. In this VMblog Q&A, Surace discusses the evolving threat landscape, the security implications of agentic AI, and why identity, not the network, is becoming the primary control plane for enterprise security in the years ahead.
++
VMblog: Give VMblog readers a quick overview of your company and its core mission.
Kevin Surace: TokenCore.com (previously TokenRing.com) is focused on identity assurance for enterprises and government organizations. Our mission is simple: prove there’s a real, authorized human behind every login. We do that with fingerprint-based identity backed by cryptography and proximity, so access is tied to a person and can’t be shared, replayed, or silently taken over.
VMblog: What does “identity assurance” actually look like for an end user?
Surace: For the user, it’s simpler than what they’re used to today. Instead of passwords or push approvals, they authenticate with a fingerprint on a secure device. Behind the scenes, that action is backed by cryptographic keys that never leave the device and can’t be reused or shared. It’s fast and familiar for the user, but a much stronger guarantee for security teams.
VMblog: What does traditional MFA break down most in real-world attacks?
Surace: MFA still depends on things that can be tricked out of users – codes, approvals, sessions. That’s why we keep seeing phishing, MFA fatigue, and account takeovers. Attackers don’t break in; they log in.
If something can be shared or approved under pressure, it can be exploited. We remove that entirely.
VMblog: What were your key learnings from 2025’s security landscape, and how have those insights shaped your solutions for 2026?
Surace: The biggest lesson from 2025 is that attackers aren’t breaking in – they’re logging in. Breaches followed the same pattern: stolen passwords, phishable MFA, and social engineering. That’s a design problem, not something incremental fixes can solve.
For 2026, we’re focused on eliminating transferable trust. If access requires cryptographic, biometric, proximity-based proof of a real person, those attack paths largely disappear.
VMblog: How is your company addressing the intersection of generative AI and cybersecurity – both defending against AI-powered attacks and leveraging AI agents for security operations?
Surace: Generative AI has made phishing and impersonation faster and more convincing. Our response is to remove what attackers rely on – no passwords, no codes, no approvals. If nothing is reusable, there’s nothing to exploit. We do see value in AI for improving operations, but the foundation has to be hard, cryptographic proof of identity.
VMblog: With the proliferation of AI agents and autonomous systems in enterprise environments, how is your solution addressing the security challenges of agentic AI?
Surace: Agentic AI can act with real privileges, but often without clear accountability. We make sure sensitive access is still tied to a verified human. TokenCore adds that layer on top of IAM, SSO, and PAM by binding access to a physically present user. As automation grows, that human proof becomes more critical.
VMblog: What specific market challenges or pain points is your company addressing? How have these evolved from last year?
Surace: Most organizations are still relying on authentication methods attackers already know how to beat. The conversation has shifted from phishing-resistant MFA to broader risks – AI-driven phishing, account takeover, remote access, and cloud identity sprawl.
Our approach is simple: keep your stack, add a layer that proves the human behind access.
VMblog: What sets your solution apart in today’s crowded cybersecurity marketplace?
We’re not just another MFA app. TokenCore binds access directly to the individual using fingerprint verification on secure hardware, with cryptographic keys generated and enforced on the device and tied to proximity.
No secrets to steal. No approvals to trick. Nothing to reuse.
And we layer into existing systems, so the security gain is real without a full overhaul.
VMblog: How is your company addressing the evolving challenges of supply chain security, particularly with the integration of AI components and open-source dependencies?
Surace: Supply chain risk isn’t just about code – it’s about access. Who can get into repositories, build systems, and signing environments? That’s where attacks often start.
We strengthen those entry points by proving the human upon access and reducing reliance on weaker authentication methods.
VMblog: With identity now firmly established as the new perimeter, how does your solution address identity threats, including deepfakes and AI-powered social engineering?
Surace: These attacks work by stealing something transferable – a password, a code, or an approval.
We remove that category entirely. TokenCore requires on-device fingerprint verification backed by cryptography and proximity, so access is tied to a real person. No matter how convincing the attack is, there’s nothing usable to take.
VMblog: How does your platform help organizations manage the security implications of shadow AI and unauthorized generative AI tool usage by employees?
Surace: Shadow AI often starts as an identity problem. Employees sign up for tools and move data outside visibility. We strengthen the front door by tying access to a verified human and integrating with existing identity systems. That doesn’t replace governance, but it gives organizations a stronger foundation to enforce it.
VMblog: With ransomware groups increasingly using AI and targeting cloud infrastructure, how does your solution help organizations better prepare, detect, and respond?
Surace: Ransomware usually starts with compromised credentials. We focus on stopping that first step. Remove password reuse and phishable MFA, and you cut off one of the most common entry points. It’s about preventing access, not just responding later.
VMblog: What’s your approach to securing the software development lifecycle, especially with AI-assisted coding tools becoming mainstream?
Surace: AI is speeding up development, which makes identity controls even more important.
We secure access to repositories, build systems, and signing infrastructure by tying it to a verified, physically present user. That helps prevent stolen credentials from being used to alter code or compromise releases.
VMblog: How is your company addressing the challenges of securing distributed workforces and cloud-native architectures in 2026?
Surace: Remote work and cloud environments have exposed the limits of traditional MFA. TokenCore makes authentication portable for the user, but not transferable to the attacker. With biometrics, secure hardware, and proximity, organizations can raise assurance without adding friction.
VMblog: How does your solution help organizations address the expanding regulatory landscape, including AI governance requirements and emerging global privacy regulations?
Surace: Regulators are increasingly focused on identity, access, and accountability. Our approach supports that by keeping biometric verification on the device, generating cryptographic keys locally, and eliminating shared secrets. That strengthens assurance while aligning with modern privacy expectations.
VMblog: What’s your perspective on the most critical cybersecurity trends that will shape the industry in 2026-2027?
Surace: Three trends stand out:
- AI will continue accelerating social engineering and attack automation.
- Identity will replace the network as the primary control plane.
- And the gap between MFA and true identity assurance will become much clearer.
The organizations that win will be the ones that focus on proving the human behind access.
##
