Agent Certification Is a Photograph. Trust Is the Film.

In the space of about one week this September, agent vetting stopped being a niche concern and became an industry.

At Fal.Con on August 31, CrowdStrike launched its AI Partner Specialization, including a Verified Agent certification that validates partner-built agents against CrowdStrike's requirements before they're published to its marketplace. The next day, a startup called AIR emerged from stealth with $50 million — two seed rounds, led by Sequoia and Greenoaks — to discover the agents running inside companies and vet the skills and add-ons those agents load. Tenable shipped an AI Inspector for vetting third-party agents in the same news cycle.

The vetting economy is here. Good. Somebody needed to build it.

Now let's talk about what a certification badge actually is: a photograph. A statement that on a particular day, under particular conditions, an agent (or a skill, or an MCP server) looked clean to a particular reviewer. That statement is useful. It is also the beginning of a trust story, not the end of one — and the companies selling certification will tell you so themselves, if you listen closely.

The vetting industry's own fine print

Start with AIR's numbers. The company says it filters out roughly 27% of the agent skills and add-ons it finds online — a striking figure on its own. But the more interesting detail in their pitch is what they do after approval: AIR continuously re-evaluates components, because a skill that passed review can turn hostile later. Dependencies change. Developer accounts get compromised. The thing you certified in September is not reliably the thing executing in your environment in October.

AIR's CEO Yair Saban frames the problem as a signing gap: "Every time you install a driver, you see a signature saying who signed it... You don't have that with skills or plug-ins or MCPs." He's right. But notice what even a perfect signature gives you: provenance. Who built it, and whether it's been altered. A signature has never told anyone what the signed thing will do with production credentials at 3 a.m. on a Saturday.

Meanwhile, the enterprises deploying these agents are far behind even the photograph stage. Okta's AI Agents at Work 2026 report — surveying 292 executives and 492 knowledge workers across seven countries — found that only 34% of organizations apply the same security controls to their agentic workforce as their human one, and 58% of executives reported an AI-related security issue or close call in the past year. Certification programs will raise the floor here, and they should be welcomed for it. A marketplace that rejects a quarter of what it inspects is doing real work.

Three ways a photograph fails

The gap between certification and trust isn't a marketing distinction. It's structural, and it fails in three specific ways.

Drift. The certified artifact changes after certification. Supply-chain attackers have fully internalized this: compromise the update channel, not the initial release. The badge stays green the whole time. This is precisely why AIR re-scans continuously — point-in-time review is a known-insufficient control even to the people selling it.

Context. Certification happens in a lab; deployment happens in your tenant. A "verified" agent tested with sandbox permissions is a different risk object once it holds your production API keys, your customer data access, and delegation authority over three other agents. No third-party reviewer certified that configuration, because no third-party reviewer has seen it.

Behavior. This is the one that matters most. The failure modes that actually burn agent operators — memory poisoning, goal drift, prompt-injected tool misuse, an agent quietly widening its own scope — are runtime phenomena. They don't exist at inspection time. They exist in the event stream: the sequence of tool calls, refusals, escalations, and anomalies an agent produces while working. A badge cannot see an event stream. By definition, it was issued before the stream started.

Certification is an input. Trust is a computation.

Here's the model we think the industry lands on, because it's the only one that closes all three gaps: treat certification as one signal feeding a live trust score, not as a substitute for one.

That's how VeriSwarm is built. Passport handles the photograph layer properly — signed manifests, ES256-signed portable credentials, explicit delegation chains — so an agent's provenance and claimed capabilities are cryptographically checkable, and a marketplace certification can ride along as an attestation. Identity and provenance, done right, are the prior.

Then Gate runs the film. Gate ingests the agent's actual behavior as events and maintains a continuous trust score against policy tiers — so a certified agent starts with a better prior, and then its score moves with what it does, not what it once was. Drift shows up as scoring anomalies. Context is handled because the score is computed on your deployment's events, not a lab's. And when behavior falls off a cliff, the decision layer doesn't file a finding for next quarter's review — Guard's kill switch ends the session now, and the whole episode lands in Vault's hash-chained audit ledger for the postmortem.

Certification answers "should this agent be allowed in the building?" Trust scoring answers "should it still be in the building, right now, doing that?" You need both questions answered, continuously, and only one of them can be outsourced to a badge.

The vetting economy that arrived this month is real progress — it means the market has accepted that agents are a supply chain, with a supply chain's failure modes. The next step is accepting that agents are also a workforce, and nobody manages a workforce with a photograph taken on hiring day.

Gate is VeriSwarm's always-on foundation — trust scoring starts free. Point your agents' events at it and find out what your certified agents have been doing since the photo was taken.

Sources: CrowdStrike press release, TechCrunch on AIR's $50M raise, Okta: AI Agents at Work 2026.