What are the stakes in the race towards cyber security in 2025?
Being able to trust digital interactions has become fundamental to modern society. A huge portion of GDP and productivity is now tied to systems and services that are entirely digital. The attacks themselves may target money, but the implications go far beyond. If we cannot trust who or what we are interacting with online, the very foundations of a functioning society are threatened. The identity industry has become the defender of digital trust, and that trust has now been weaponized.
We have moved from implicit trust to explicit trust, to verified trust. Today, the principle “trust but verify” is no longer enough—only the verified will be trusted.
Every user, every API endpoint, every device and now every AI agent that interacts with our systems must be verified, or else deemed untrustworthy. This has become a race to verify every participant in the digital ecosystem so that our most critical assets—our data and our money—are protected. It’s important to remember that money today is nothing more than a field in a database. That makes it both immensely powerful and alarmingly easy to move, which is why billions are being siphoned off through compromised digital systems.
You mentioned that this is called the identity industry. What is that, and what is Ping’s role within it?
The starting point for securing anything is identity: you cannot secure what you cannot identify. Every digital interaction begins with the question, “Who are you, and how do I know it’s you?” That applies to humans, devices, machines, APIs, and AI agents. Just as computers must authenticate one another in order to communicate securely, so too must every agent, whether human or non-human, prove its legitimacy. The role of the identity industry is to provide this assurance at every point of interaction, protecting against impersonation and compromise.
Ping Identity serves the world’s largest enterprises by securing the integrity of both human and non-human identities. We do this through strong authentication and authorization—confirming that a person or machine is who they claim to be, and then controlling what they are allowed to do. Today, we protect over 8 billion accounts globally. In practice, this means that the technology sitting behind logins, transactions, and access points in complex organizations is built to ensure digital trust. In short, Ping enables organizations to “Trust Every Digital Moment.”
Your verified trust framework leverages AI to counter threats like deepfakes and voice cloning. How do you ensure users are accurately verified, and how do you stay ahead in this race against adversaries?
AI is essential in the fight against fraud because it allows us to detect deepfakes and synthetic identities. For example, when verifying an ID, advanced cameras can now pick up subtle markers of authenticity in a driver’s licence or passport. Liveness tests—asking users to take a selfie or perform an action—help reveal whether the interaction is genuine or an injected video. AI parses the signals from the noise, identifying fraudulent attempts to impersonate or create false identities. This is a cat-and-mouse game that will continue indefinitely, as adversaries evolve new techniques and defenders respond in kind.
Staying ahead requires using AI not just defensively, but also to accelerate our own innovation. Our platform includes Helix, a generative AI solution designed to be used in a secure, controlled way across our products. For example, we have built agents that can actually design other agents, multiplying the speed of development. Think of it as robots that can build other robots—if your competitor is still building manually, you have an exponential advantage. That’s how we aim to maintain an edge: by creating secure, scalable frameworks that evolve faster than the threats.
Tell me about your partnerships with telecom carriers, messaging platforms, and IoT providers. How are these expanding Ping’s reach and enabling real-time authentication in global ecosystems?
Our partnerships focus on identity verification, which is distinct from authentication. Logging in with an email or phone number proves access to that channel, but it doesn’t verify who the person really is. Verification steps in where higher assurance is required—like opening a bank account, where regulators demand that the individual is positively identified. This involves combining techniques such as ID checks, cross-referencing databases, and validating phone numbers or emails against their reputations. For example, a number active for 10 years is far more trustworthy than a burner SIM acquired last week.
We work with telcos and other data providers to strengthen this process. Partnerships allow us to verify IDs against government databases, or to flag suspicious credentials created with false names. These services operate invisibly under the surface, but they are the backbone of trust in digital society. Ultimately, most fraud comes from people trying to mask or falsify identity—whether in the physical world with a hoodie over their face, or online with a stolen email. By strengthening verification, we reinforce the integrity of all digital interactions.
Is there any particular approach or technology you see as the future of authentication?
I see two main approaches. The first is decentralized identity, specifically the use of digital verifiable credentials. These are essentially digital versions of physical IDs stored securely in a phone’s wallet. Bound both to a secure chip in the device and to the user’s biometrics, these credentials create a very strong form of authentication. To use them, you must prove liveness, pass a biometric check, and use the cryptographic key tied to your device. It’s far more secure than passwords, which can be phished or stolen en masse.
The second approach is advanced biometrics and behavioral recognition. Just as humans subconsciously authenticate one another through appearance and behavior, digital systems will evolve similar senses. Cameras and sensors will assess patterns of behavior and physical markers with increasing accuracy. Biometric authentication isn’t perfect, but it adds significant convenience while raising the cost of breaches. These two approaches—decentralized digital credentials and biometric recognition—will shape the future of secure interactions.
Do you think decentralization will extend beyond authentication into other areas of technology?
Yes, decentralization will play a much broader role. One of its key advantages is privacy. Centralization is efficient, but it also creates a single point of failure—abuse it, and you can harm the many. Decentralization, by contrast, empowers individuals to control their data and prove facts about themselves selectively. This is a fundamental improvement in privacy and trust.
Today, when you show up online, you have no way to prove anything about yourself beyond basic login credentials. In the physical world, we carry driver’s licences and passports, but in the digital world, we don’t yet have equivalents. Digital credentials will change that. They will allow individuals to instantly prove employment, status, or membership in a privacy-preserving way. Moving from low-trust to high-trust in milliseconds is transformative, and I believe it is inevitable.
You founded Ping in 2002. What’s the story behind the company name?
The name came from the phrase “Ping me,” which was already part of everyday vernacular. I wanted something that would carry meaning both in daily life and in the digital identity space. “Ping my ID” resonated as a way of signalling trust. One of our products today is called PingID, which brings that original vision full circle. It’s about making Ping synonymous with a trusted signal of identity.
Over 20 years later, that choice still carries weight. To say “Ping my ID” is to invoke not just a casual phrase, but a brand that has become embedded in the architecture of digital trust.
Considering your decades in identity security, what has surprised you the most?
At this point, not much surprises me, but I have developed a deeper appreciation for the complexity of global enterprises. Ubiquity takes time, and layering new technologies on top of decades-old infrastructure is far harder than most realise. Large organizations may still rely on mainframes from 35 years ago, or on thousands of custom applications written in outdated architectures. Bringing those forward into the present threat landscape is an enormous challenge.
What I’ve learned is that securing the world’s infrastructure isn’t just about deploying new technology—it’s about integrating it with the legacy systems that underpin global business. The long tail of complexity is real, and it shapes how quickly and effectively we can adapt. That is the reality of building and maintaining trust at internet scale.
