Cybersecurity
Trust infrastructure across organisational boundaries, without a central broker
Inside your organisation, Zero Trust knows what to verify against: your identity provider and your device inventory. Across the boundary to a supplier, a service provider or a regulator, it does not. Vereign is built for that boundary.
Discuss trust between organisations
NIS2 requires organisations in scope to secure their supply chain, including their relationships with direct suppliers and service providers, and the Cyber Resilience Act sets security duties for products with digital elements across their lifecycle. Both duties cross organisational boundaries, where there is no shared identity provider to verify against unless both parties join a federation. Vereign builds trust infrastructure across organisational boundaries, without a central broker: organisations that verify against each other's key event logs check identity and integrity themselves, and the same model would extend to AI agents and connected devices acting for them. SEAL, Vereign's delivery product, already handles 800,000+ verified deliveries per month in Swiss healthcare.
Regulatory drivers
Zero Trust adoption
A Gartner survey published in April 2024 found that 63% of organisations had fully or partially implemented a Zero Trust strategy, most covering half their environment or less. For collaboration across enterprise boundaries, NIST SP 800-207 offers federation.
63% fully or partially implemented (Gartner, 2024)
Cyber Resilience Act
Manufacturers of products with digital elements must meet security requirements, handle vulnerabilities across the product's support period, and report actively exploited vulnerabilities. Importers and distributors must check that the manufacturer has met these duties, so evidence about a product's security passes from one organisation to the next.
Reporting obligations have applied since 11 September 2026
NIS2 Supply Chain Security
Article 21(2)(d) requires supply chain security measures, including the security of relationships with direct suppliers and service providers. CISOs have to establish trust across their supplier ecosystem, beyond their own perimeter.
Article 21(2)(d): supply chain security
Solution overview
Cross-organisation trust for cybersecurity means that what crosses a boundary between organisations carries cryptographic proof of origin, integrity and authorisation, which counterparties that verify against key event logs can check themselves. Messages are where this runs today, in production in Swiss healthcare. Structured data exchange, API calls, AI agents and device attestations are cases the same model would extend to. Communication is one use case. The primary capability is trust where organisations meet.
See how it works →OSSTMM measures operational security quantitatively as security controls, visibility, trust, and exposures. But all other testing frameworks stop at the organizational perimeter. Cross-boundary trust between organizations is a gap that no penetration test can measure. Trust itself is something no other framework can measure. However, DKMS makes that trust verifiable and testable for the first time security teams can actually validate trust between organizations.
Where this would extend: non-human identity
Security teams increasingly use the term non-human identity (NHI) for services, workloads, AI agents and devices. Our definition: A non-human identity is the identity of a software or hardware actor: a stable identifier, bound to the authority the actor currently holds and to the person who answers for it. Its credentials prove that identity; they are not the identity.
Answerable by design
In DKMS, an NHI would be modelled as a delegated identifier whose delegator is the organisation that answers for it. Its rotations need that organisation's anchoring, and its authority is expressed as credentials that chain back to the organisation. The underlying protocol makes no distinction between human and non-human controllers.
Between organisations
Inside a single trust domain, workload identity systems such as SPIFFE work well. The DKMS properties matter when an NHI acts for one organisation and another organisation has to check it: self-certifying identifiers, pre-rotation, and delegation chains a verifier can check without calling the issuer.
VERIMESH Agent (roadmap)
VERIMESH Agent, a roadmap edition, would give AI agents and automated systems zero-trust service identity on this model, so that a receiving organisation would be able to check which organisation an agent acts for and within what scope. It is not yet available, and no public agent-facing API exists today.
Integration projects for non-human identity
Organisations that need verifiable identity for AI agents, automated services or devices acting across organisational boundaries can scope this with Vereign as an integration project. The project would model each agent, service or device as a delegated identifier (DKMS, built on KERI) whose credentials are issued, and can be revoked, by the organisation that answers for it. VERIMESH Agent and VERIMESH Edge are roadmap editions, not yet available, and there is no public agent-facing API today. A project would cover what the organisation needs: delegated identifiers for its agents, services or devices, the credentials that state what each may do, revocation of those credentials by the organisation as issuer, and verification by counterparties in other organisations. It would build or configure that delegated-identifier path for the organisation; Vereign's current production deployments do not include it. An engagement starts with an architecture conversation, followed by scoping and then the project itself.
Request a technical architecture reviewPost-Quantum Ready by Design
Quantum computing does not need to arrive to pose a threat. Data harvested today under encrypted channels will be decryptable once quantum capability matures. KERI -- the cryptographic foundation of Vereign's trust infrastructure -- is architecturally ready for the post-quantum transition, not because it already uses post-quantum algorithms, but because its design makes the transition seamless.
Harvest Now, Decrypt Later
Adversaries are harvesting encrypted data today for future quantum decryption. NSA, CISA, and NIST jointly warn that high-retention data -- healthcare records, financial transactions, legal documents -- faces exposure windows measured in decades. The threat is not future. The data collection is happening now.
NIST Standards Finalised
FIPS 203, 204, and 205 were finalised in August 2024, establishing ML-KEM, ML-DSA, and SLH-DSA as post-quantum cryptographic standards. The migration window is now open. Organisations that wait for quantum computers to arrive will be years behind those that prepare their cryptographic infrastructure today.
KERI Crypto-Agility
KERI's pre-rotation mechanism and algorithm independence mean keys can be rotated to post-quantum algorithms without breaking the trust chain. Unlike PKI/CA-based systems locked to specific cryptographic assumptions, KERI enables incremental migration -- each organisation upgrades at its own pace without infrastructure overhaul.
Proven at scale
Healthcare is critical infrastructure. Verimesh is in production in Swiss healthcare: the gateway and central CA at HIN run in production, the first customers are migrated and using them, and migration across the HIN network is planned to complete before the end of 2026. The architecture is not specific to healthcare: the same trust model would apply to security attestations exchanged between organisations.
Production infrastructure in Swiss healthcare. Verimesh is designed so that counterparties that verify against key event logs check each other without a central trust authority. Where a counterparty validates only X.509, as at HIN today, a bridge certificate authority connects the two.
Reference architecture
Click to expand diagram
How to engage
Work with Vereign directly
For organisations that want to scope and deploy trust infrastructure with Vereign's engineering and advisory team. Ideal for first movers and organisations with in-house technical capacity.
Explore services →Work through a partner
For organisations that prefer to work with a consultancy already trained on Vereign's trust infrastructure. Partners provide sector expertise alongside deployment capability.
See the partner programme →Trust infrastructure for the organisations you work with, without a central broker
Whether you are a CISO extending a Zero Trust programme to suppliers and partners, or a security consultancy building a new practice area, we can scope how trust between organisations fits your existing stack.