No Passwords, No Secrets: How Badge Is Building a Trust Layer for Humans, Machines, and AI | Dr. Tina Srivastava

Russ Fordyce (00:00): Welcome back to the Winner Circle. I am here today with Dr. Tina from Badge Inc. Now, this is a really interesting play — this is a cybersecurity award winner for the Fortress Awards. Badge is now kind of this authentication layer that is becoming more important in the AI world. So, Dr. Tina, welcome to the winner circle and congratulations on all the awards. Dr. Tina Srivastava (00:23): Thank you, we're honored to be here. Russ Fordyce (00:25): So authentication I think of as typing in my password into Chrome and then it asking me a million times for pass keys and re-authentication. It's gotten super complicated for a good reason, because it's really the attack vector now. So tell us a little bit about Badge and what you guys are doing to solve this new problem. Dr. Tina Srivastava (00:50): Absolutely, Russ. We've turned it on its head a little bit. A lot of authentication has involved storing secrets — password hashes, knowledge-based things like where you live, what your favorite ice cream flavor is. None of those are secure, and none of those can make it in the age of AI where phishing attacks are on the rise and a lot of those things can be emulated. Badge is able to create a root of trust to make sure you are the human, or that the machine is the machine, or that the agent is the agent, in order to authenticate a transaction. Russ Fordyce (01:31): So you co-founded Badge with Dr. Charles Herder around 2019. What was that moment that made you say this has got to be solved — I am now dedicating my career to solving identity and access? Dr. Tina Srivastava (01:48): The moment was related to my background in national security. After MIT, I was at Raytheon working on electronic warfare systems. I noticed that in those worlds, if you work in national security, you have a security clearance — so my fingerprints were stored in the Office of Personnel Management database. And then OPM got breached. Six million people, including Charles and me, had our fingerprints compromised. This was an eye-opening moment: how do I prove that I'm Tina without giving up my private data, having it be stored in a central database waiting to be attacked? We knew there had to be a better way, and that is what led us to found Badge — identity without secrets. Russ Fordyce (02:43): Yeah, and I know a little bit about this because I had Dr. Herder on as well. What you guys are really doing is astounding — you've taken and flipped it on its head. You've taken this scheme of storing the secrets in the browser or on our phone, and now you're saying we're not going to store that at all, but we're going to be the most secure. And you do this through zero-knowledge authentication. Can you explain in plain terms how nothing is ever stored? Dr. Tina Srivastava (03:24): That's exactly right, Russ. What we do is we allow users to derive a key on the fly. No secrets are stored, only public keys. And that allows a user to be their root of trust — whether they're on a new device, whether they're in a different application, whether they're in a completely new scenario, they're the root of trust and they're able to re-derive their key on the fly. This is ever more important in the world of agentic AI. We really want to make sure that these agents are enabled to do their tasks so that they can be useful to us. But at the same time, we don't want super agents that are overprivileged or an agent that pretends to act on your behalf without authorization. With Badge, we make it seamless to ensure that the true verified human authorized the task while still making it efficient for these agents to assist. Russ Fordyce (04:28): Walk us through what someone using Badge actually does. They're not using a password — what are they doing? Dr. Tina Srivastava (04:42): Badge supports any factors — whether that's face, fingerprint, biometric factors (without storing the biometric data), or other factors like context, device characteristics, even PIN codes used in combination. The flexibility allows you to create N-out-of policies, like two out of three. You can use any combination of factors available to re-derive your key and authenticate. That allows resiliency in difficult scenarios — if you lose your device or you're on a shared device. It allows you to not fall back to phishable account recovery. And when you're talking about machine and workload identity, one of the great things about this award is the recognition of our AI platform — enabling MFA for workloads, taking away those static API credentials and using multiple sources to re-derive keys. Russ Fordyce (05:50): Yeah, that's a big problem in the agentic AI world where you might have different programs running and doing different things — they're constantly asking for permissions because they're working across systems and permission roles. We thought getting into Gmail was bad, now you're having to do that times a million. One term I needed help understanding from your nomination was biometric fuzzy extraction. Can you explain what that is and what it means to privacy? Dr. Tina Srivastava (06:37): Of course — that is the core of the innovation. Fuzzy extraction is what allows Badge to make it so that you can extract or derive a private key from any fuzzy factors that may not be cryptographically precise, like biometrics, like human behavior. These things are not binary, and yet — because of fuzzy extraction — you can take these fuzzy inputs, these analog inputs, and derive a cryptographic key. A true, exactly-every-bit-matters key. One way to think about Badge is we're able to marry these two worlds of the human, the fuzzy, and the cryptographic and precise. Russ Fordyce (07:33): Yeah. So it seems like you guys are sitting in front of all these access systems — fingerprints, keypads, whatever that might be — and using fuzzy logic to say, out of all of these, is this person valid? Is that about right? Dr. Tina Srivastava (07:58): That's exactly correct. You got it, Russ. Russ Fordyce (08:00): Okay. Super interesting. Now we've talked about agentic AI — it's the catchphrase of 2026. How is authenticating agentic AI so different from authenticating humans? Dr. Tina Srivastava (08:31): Yeah, there are a few things that make this world very different. Let me start on the attack side. Think about a simple phishing email — we started to be able to detect them: lots of typos, I wasn't expecting this email with this link. But now AI supercharges these attacks. You can have really broad phishing attacks that are tailored — they know everything about you, Russ, what you've researched, what you're looking to buy, what emails you might be expecting, and they can at massive scale tailor those to exactly what you might click on. And then AI means they learn — what types of attacks are effective and how to be more successful globally. That is why it's more important than ever to have phishing-resistant authentication, which is what Badge does. On the efficiency side, we also want to use AI for good. Let's say you're a programmer and your AI agent detected some updated CVEs in your code and prepares that code to be pushed as an updated version. That saves you a lot of time, but before a push can be made to prod, you want to make sure that the true developer double-checked and that we don't have rogue agents pushing changes to our production systems. Badge enables that secure check so that the agent can do their work autonomously, but the final important access is verified cryptographically by a human before it happens. And we enable zero standing privileges for agents — so if you have someone in HR who wants to use a calculator agent to do analysis on salaries, the agent only has access to those salary databases when in use by that HR employee. Once done, the agent returns to zero standing privileges. That's how Badge makes agents powerful while putting the right guardrails in place. Russ Fordyce (12:13): Yeah, and it's really interesting where AI companies are finding success — in helping others access, organize, and contain the AIs. And you've moved into this kind of Intel-inside model where you're embedding Badge into authentication layers inside devices. Tell us how you're doing that and what it means for your ongoing success. Dr. Tina Srivastava (13:08): That's exactly right, Russ. We are sort of like that Intel inside — our partners have OEM'd Badge into their product lines. And what that is is a recognition that Badge is the trust layer behind humans, machines, and AI. Because we enable a system where there are no stored secrets, it really is the next generation of security, and being able to apply that across systems, across boundaries, across domains and federation boundaries, it enables you to prove you are who you say you are in a way that is secure. Russ Fordyce (13:49): You're attacking a market that's pretty well established — you're going against some big players: Okta, Microsoft, Ping, CyberArk. They all have existing solutions inside the enterprise. How do you fit in? Are you replacing that identity stack? Dr. Tina Srivastava (14:12): We're proud to call many of those companies our partners. We have integrations with all of them, and we're very excited that with Badge, it's really a complementary ecosystem. Badge is able to extend our reach even farther because of those partnerships where we're embedded inside these products. That allows us to take this technology — which is very horizontal across multiple verticals — healthcare, finance, manufacturing — and make sure that the people who need this have access to it. Russ Fordyce (14:48): Yeah, I love these types of arrangements. It's like I remember growing up it was BASF — we don't make the paint, we make the paint better. And so I love that customers are able to plug those things in through that one relationship model, which is really important in tech because it's getting more complex every day. How does that make you feel having these validated relationships and taking you into their channel? Dr. Tina Srivastava (15:31): It's been fantastic and we've really grown on that side, especially this year in more and more areas. We see that as a recognition of what Badge brings to the table and how this core innovation really is ubiquitous — solving key challenges whether you're a nurse in a healthcare environment, on the factory floor, or a consumer trying to access your bank account. If we can broaden our reach through these partnerships and OEM relationships, that's been really exciting for Badge. Russ Fordyce (16:07): Is there any other category you're looking to break through into? Dr. Tina Srivastava (16:17): Well, all of our partners are bringing us in on the AI side as well. And that's really what this award recognizes. Seeing that it's both humans accessing things as well as agents — and when you talk about an agent, it's called an agent because you're giving it agency to act on your behalf. That can only really be verified if there's a true human at the end of the line. That's very critical in this world of gen AI to ensure authenticity. And that's what Badge brings. Russ Fordyce (16:55): Well, I loved in the nomination what you guys talk about — a trust layer for humans, machines, and AI. And it really is all three of those. I always think of AIs as new employees right now — they vary in knowledge about the company, but they're new employees and you have to bring them up to speed and trust them, just like another employee. But these things are getting smarter faster. Where do you think in three to five years — what does that trust layer look like and what needs to be true for Badge to continue to be the standard infrastructure for identity in this new agentic AI world? Dr. Tina Srivastava (17:37): Yes, well, one way to think about it is what would happen if we weren't around. I think there's a risk of eroding trust in these systems — people will not be able to fully embrace them if they're constantly worried about fraud and breaches. There will be too much reluctance to really embrace these new technologies. I think the whole world benefits if we can use these technologies in a safe and secure way with the appropriate guardrails, which is what Badge brings. We really want to unlock this whole technology era for people. And the way to do that is to make it easy, make it seamless, make it accessible. Just as you started with — instead of having this frustration of constantly worrying about where's my phone and where's my push and I can't get into this system on an unrecognized device — instead of all that frustration, we take that away. As long as you're you, you can access your systems, your data, wherever you are. And that's what we're going to show is true for all consumers in this world of AI — that anyone anywhere can be enabled with these AI helpers to do things they never thought possible, and not have to constantly worry about whether the AI got access to something it shouldn't have or leaked data it shouldn't have. And others can rely on that certainty: when Russ does something, others can know that Russ truly authorized that, he truly posted that information, he truly made that transaction. And that is what really makes the economy and the world go round. Russ Fordyce (19:28): Yeah, super interesting. I am so glad that you guys are looking at this stuff and making it better. It is certainly a frustration for all of us — it can only get better, it's only gotten more complex. And then you start adding the word quantum into all this stuff and it gets even more complex, which I know you guys are surely looking at. So Dr. Tina, thank you so much for joining us, and congratulations on all the success. We wish you guys all the best. Dr. Tina Srivastava (19:54): Thank you so much. Glad to be here.