Socure Agent Intelligence: Scoring Whether AI Agents Can Be Trusted
Key Takeaways
- Socure launched Agent Intelligence on 27 October 2026, a suite that detects AI agents, scores whether they should be trusted, and ties each agent to the verified person or business that authorised it.
- The suite has three layers: Agent Detection, generally available now inside Socure's Digital Intelligence offering; Agent TrustScore, open for beta customers now; and Agent Credential, reaching general availability in Q1 2027.
- Socure says controlled lab tests identified named consumer agents, including Muse and Instinct, with 99.99 percent accuracy.
- TrustScore rates an agent on three separate dimensions, identity, authorisation and risk, with scores returned separately so customers can decide which attributes matter for their use case.
- The launch responds to a concrete problem: most companies currently treat agents like bots and block them, which also blocks legitimate customers who arrive through agents.
- Socure's own figures frame the scale: daily requests from AI agents grew by more than 1,700 percent in the year to September 2026, and for the first time more than half of internet traffic was not human.
The problem nobody had a name for until now
A customer visits a website. A human is behind the visit, but the human is not the one clicking. An AI agent is doing the browsing, comparing, booking or buying on the human's behalf. The website sees traffic that looks automated, because it is automated, and its defences do what they were built to do: block it.
That is the problem Socure Agent Intelligence is built to solve. Most organisations cannot differentiate traffic from new consumer agents. They cannot see them, do not know how many there are, and do not know what they are doing. The problem compounds because an agent puts another layer between the action and the person accountable for it, and every verification method in production at scale today was built to evaluate a human. A password, a fingerprint or a face check verifies a person. It says nothing about whether the software acting for that person is legitimate, authorised and safe.
Socure's founder and chief executive Johnny Ayers framed the dilemma bluntly. He said that human traffic is going to look like a rounding error next to agent traffic very quickly, but most companies still treat agents like bots and block them. That strategy stops working, he argued, the moment a company's best customers attempt to engage with it using an agent such as Muse or Instinct. He summed up the alternative in a second line that is worth remembering: block them all and you block your next customer, but let them all in and you hand fraudsters the keys.
The scale behind the launch is striking. Socure says daily requests from AI agents grew by more than 1,700 percent in the year to September 2026, and that for the first time more than half of internet traffic was not human. According to Accenture's 2026 Consumer Pulse report, 85 percent of consumers were open to collaborating with an AI agent and 74 percent were open to having the agent execute specific tasks. McKinsey has estimated that AI agents could mediate between $3 trillion and $5 trillion of global consumer commerce by 2030. Those figures come from different sources and measure different things, but they point the same way: agent traffic is not a niche. It is becoming the default way customers interact with the internet.
What Agent Intelligence actually does
Agent Intelligence is a suite, not a single tool, and its three layers answer three different questions. The first question is: is this traffic an agent at all? The second is: should this agent be trusted for this action? The third is: can this agent prove, cryptographically, who it represents and what it is allowed to do?
Agent Detection answers the first question. It spots and classifies AI agents in a service's traffic, and it is generally available now inside Socure's existing Digital Intelligence offering. Socure says controlled lab tests identified named consumer agents, including Muse and Instinct, with 99.99 percent accuracy, using behavioural models built across 700 telemetry variables. Detection also provides confidence scores and reason codes to determine when control of a browser session shifts from a human to software. That handover moment matters, because a session that starts human and becomes agent-driven is exactly the pattern that simple bot detection misses.
Agent TrustScore answers the second question. It judges whether a given agent, and the action it is attempting, should be trusted, and it is open to beta customers now. The scoring system is based on identity, authorisation and risk, with scores on each metric returned separately, so customers can decide on the attributes that matter most depending on their use case. That separation is a deliberate design choice. A travel booking agent and a bank transfer agent should not be judged by the same single number. A customer should be able to require strong identity for payments, strong authorisation for account changes, and a low risk score for high-value actions, each independently.
Agent Credential answers the third question. It gives an agent verifiable proof of who it is, who it represents and what it may do, and it is due to reach general availability in Q1 2027 according to Socure's announcement. The credential uses W3C Verifiable Credentials issued through SocurePass, cryptographically binding autonomous agents to verified human profiles in Socure's identity graph, which the company describes as covering 11 billion decisions. The design means relying websites do not need to call central servers to check a credential, which matters for latency and for privacy.
Together, the three layers are designed to go beyond simple Know Your Agent solutions. Socure divides the existing Know Your Agent category into two camps, and argues that both are incomplete. Edge vendors detect automation but know nothing about the person behind the action. Credential schemes verify an attestation but cannot evaluate the principal who issued it. Both answer what is making a request. Neither answers whose agent it is, or whether that person should be trusted. Agent Intelligence is Socure's attempt to answer both questions in one platform.
Why blocking agents is a failing strategy
The most useful way to understand this launch is to consider what happens if companies do nothing. Today, the standard response to unrecognised automated traffic is to block it. That response made sense when automated traffic meant scrapers, credential stuffing and fraud bots. It makes less sense when automated traffic increasingly means a legitimate customer's agent booking a flight, comparing insurance or managing a subscription.
Blocking has two costs, and both are growing. The first is lost business. A customer who sends an agent to buy something, and finds the agent blocked, will buy elsewhere or not at all. As agents become the normal way people shop and manage services, a block-first policy becomes a tax on every customer who prefers to delegate. The second cost is false confidence. Blocking the obvious bots does nothing about the sophisticated ones, which are precisely the agents a fraudster would use. A company that blocks agents indiscriminately has not solved fraud. It has only hidden the difference between good agents and bad ones.
The alternative is not to let everything through. It is to distinguish. That requires identity infrastructure built for agents, which is a genuinely new category. Human identity verification asks: are you who you claim to be? Agent identity verification asks three questions at once: is this software what it claims to be, is the person behind it verified, and is this specific action within what that person authorised? Socure's three scores map directly onto those three questions, which is why the product structure is more informative than the marketing around it.
There is a related problem that Agent Intelligence also touches: accountability. When an agent makes a mistake, a bad purchase or an unauthorised action, somebody has to be responsible. Today, that chain of responsibility is murky, because the website dealt with software, not with a person. By binding each agent to a verified person or business, Socure is trying to restore the chain. If an agent's actions can be traced to a verified principal, then disputes, refunds and fraud investigations have a starting point that does not exist when agents are anonymous traffic.
How this connects to the wider agent economy
Agent Intelligence does not exist in isolation. It sits at the intersection of two larger trends. The first is the agent economy itself: agents that book, buy, negotiate and manage on behalf of users, with commerce volumes that McKinsey estimates could reach trillions of dollars by 2030. The second is the identity and access problem that agents create, which is visible in adjacent products. 1Password's agent login tackles a neighbouring piece of the same puzzle, letting agents sign in without ever seeing a user's password. Socure tackles the other side: letting a website know whether the agent knocking on its door should be trusted at all.
For readers new to the field, our explainer on what AI agents are and how they work gives the background. The short version is that agents are software that pursues goals, uses tools and takes actions with limited human supervision. That autonomy is their value and their risk. A system that can book a holiday can also book the wrong holiday, and a system that can access a bank account can be hijacked to drain one. Trust infrastructure is what lets the value grow without the risk growing faster.
The competitive landscape is still forming. Socure's main advantage is its existing identity graph and its customer base in financial services, where identity verification is already a regulated necessity. Banks, payment companies and marketplaces are the natural first buyers for agent trust scores, because they already verify humans and already lose money to fraud. The open question is whether the same product appeals to retailers, travel companies and media platforms, where the fraud problem is real but the identity infrastructure is thinner.
There is also a standards question. Agent Credential uses W3C Verifiable Credentials, an open standard, which helps adoption. But the wider agent identity ecosystem is still fragmented, with different vendors proposing different ways for agents to identify themselves. Socure's bet is that binding credentials to its own verified identity graph gives it an edge over schemes that verify an attestation without evaluating the principal. Whether the market agrees will depend on how many relying parties accept Socure credentials, and how easily agents can carry them across services.
What to be careful about
Three cautions are worth stating plainly. The first concerns the 99.99 percent accuracy figure. Socure describes it as the result of controlled lab tests on named consumer agents. Lab accuracy and real-world accuracy are different things. Agents evolve, new agents appear constantly, and adversaries actively try to evade detection. The figure is a strong starting claim, but buyers should ask for independent validation and for accuracy figures on unknown agents, not just named ones.
The second concerns availability. Only Agent Detection is generally available today. TrustScore is in beta, and Credential is not due until Q1 2027. A company buying Agent Intelligence now is buying one finished layer, one beta layer and one roadmap item. That is normal for a launch, but it means the full vision, an agent that is detected, scored and credentialed in one flow, is not yet something a customer can deploy end to end.
The third concerns privacy and power. A system that ties every agent to a verified person concentrates a great deal of knowledge about who does what online. Socure's business is identity, and its customers are the companies that want to verify people. That concentration has legitimate uses, from fraud prevention to dispute resolution, but it also raises questions about surveillance and about who controls the identity layer of the agent economy. Regulators, particularly in Europe, will watch this category closely, and the answers Socure gives on data handling will matter as much as its accuracy figures.
None of those cautions undermines the core insight. The internet is gaining a new kind of visitor, one that is software acting for a human, and the existing tools for telling friend from foe were not built for it. Socure Agent Intelligence is one of the first serious attempts to build that missing layer. Whether it becomes the standard, or one of several competing approaches, the problem it addresses is not going away. Agent traffic will keep growing, and every company with a website will eventually need an answer to the question Socure is asking: not just what is visiting, but whose agent it is, and whether it can be trusted.
