Cryptographic identity is a way to prove that a machine, service, or autonomous agent is really the one it claims to be. It relies on public-private key pairs, digital signatures, certificates, and sometimes hardware-backed keys or attestations. Instead of trusting a name or network location, systems verify proof that only the legitimate holder of the private key could have produced.
This matters because modern cyber defenses increasingly depend on machine-to-machine trust. If an attacker steals a key, forges a certificate, or tricks a service into accepting unsigned requests, they can impersonate a trusted system, move laterally, or abuse automated workflows. Defenders use cryptographic identity for mutual TLS, workload identity, code signing, and agent authentication, and they combine it with scope limits and revocation so access can be reduced or cut off when trust changes.