Estimated reading time: 9 minutes
Get The Podcast Here
“The best thing is not to have it.”
That is Raj Ananthanpillai on personal data. He is the founder and CEO of Trua. Trua sells reusable identity credentials and background screening. His case is commercial as well as principled.
He opened the episode with a dry forecast. “I’m just waiting for the next breach to be announced,” he said.
Ananthanpillai last spoke to CINI about the breach of Denmark’s ID register. An attacker used a two-person firm’s login to pull about 8.8 million records. This conversation goes wider. It covers where personal data sits, what that costs, and who should pay less.
From TSA PreCheck To A Digital Trust Token
After 9/11, airport security tightened, and lines grew. Ananthanpillai’s previous company worked on a fix called registered traveler. “You register once,” he said. “And then you can zip through any airport, any airline.”
The pilot ran in about five airports, he said. The TSA then took it nationwide as TSA PreCheck. He puts current membership at 20 to 25 million people.
The 2017 Equifax breach set him on his current path. It exposed the records of about 147 million people. He recalled a question from the congressional hearings that followed. Why does the industry rely on Social Security numbers?
The number was built for government benefits, taxes, and payroll, he said. It became the default way to verify a person. An email address can be replaced. A Social Security number and a date of birth can’t. “The thing that is sort of a DNA in you is the Social Security number and your date of birth,” he said.
His answer was to bring the PreCheck model to commerce. A person verifies their details once. They get a trust token, much like a known traveler number. They hand over the token, not the data.
The Digital Trust Crisis: Hundreds Of Copies Of You
Ananthanpillai’s book is called The Trust Crisis. He describes the crisis as a choice between two bad options. Some platforms don’t screen people at all. Others screen with heavy friction. The screening leaves copies of personal data everywhere.
The average person has handed personal details to at least a hundred places, he said. Asked how many hold Social Security numbers, he went higher. “It is hundreds, if not thousands,” he said. Even a gym may run a credit check and keep the number.
Each holder must then protect what it collected. “It becomes ten million honeypots of your data,” he said.
He has little faith in the usual remedies. Regulators fine companies. Insurance or a check takes care of it, he said. Companies respond with longer terms of service. “Nobody in the world ever reads those terms of service,” he said.
He traces the problem to the free services of the dot-com era. “The consumers became the product for all these big tech,” he said.
How Trua’s Trust Token Works
Trua verifies a person’s identity documents, address, Social Security number, and a live biometric check. It can add education, employment, and criminal record checks. The person reviews the results before anything is shared.
A business that needs to check someone gets answers, not records. It learns that a degree is verified or that no criminal record was found. “They don’t need to know the whole story about you,” he said.
The token is dynamic. It can expire after one transaction, a day, or a week. He compares the model to the credit bureaus, which gave lenders one answer in place of their own research. Unlike a credit file, he said, the person can see and check the data.
Trua encrypts the data on a blockchain with two keys, he said. The person holds one and the system holds the other. Raw data never travels.
CINI asked what stops Trua from becoming the next big target. “I’m not gonna say it’s hundred percent foolproof,” he said. He pointed to his years of security work for government programs.
The model also needs acceptance. He compared it to the launch of the Discover card. Shoppers could carry it. Merchants still had to accept it. “So you have to create that ecosystem,” he said. Trua is starting with employers.
What Digital Trust Means For Cyber Insurance
Attackers research which businesses hold personal data, Ananthanpillai said. Spread the data out and the target changes. “If I’m a hacker, I’ve got to go to a million places to hack, not one business,” he said.
He thinks premiums should follow. “If you tell the insurance, ‘Hey, I have zero data in my premises,’ your insurance should drop by 50% in my opinion,” he said.
“Eighty percent of the businesses don’t need your data on their premises,” he said.
He wants underwriters to ask what data a company collects. “Why are you collecting this?” he said.
The answer should move the price both ways. A marketing firm that lives on personal data should pay far more, he said. For a company that keeps nothing, “the insurance should be drastically reduced because there’s nothing to steal there,” he said.
His advice to buyers is to say so. Insurers will assume standard practice otherwise, he said.
Stored data also carries a long tail. “They have a five-year plan for you,” he said of attackers. “They steal something today, they’re doing something two years down the road.” Records kept for 90 days can be stolen on day one, he said.
Vendors widen the exposure. A third party played a role in 48% of breaches, Verizon’s 2026 report found. Companies vet their own hires, Ananthanpillai said. They rely on the vendor to vet everyone else. “The company was vetted, the company has insurance, but individuals may or may not have been vetted,” he said.
AI Agents And The Missing Digital Trust Layer
AI agents will make all of this worse, Ananthanpillai said. An autonomous agent has no verified human behind it.
His example was a sanctioned individual. That person could deploy an agent to make financial transactions they are barred from making. “Who is accountable for it? Who’s liable for it?” he said.
Insurers don’t yet know where to point, he said. He called the industry’s position on AI agents “chaos.”
His fix is to attach a person’s trust token to the agent. The agent then acts for a verified human, within limits. He gave the example of an agent sent to buy a briefcase with six hours of authority.
He fears a repeat of the early internet. Builders focused on what users see. “So there is no trust layer in the internet,” he said.
CINI has covered the same gap from other angles. Shufti described how an agent can pass every check and still make an unwanted payment. Arkose Labs set out why AI agents need identities.
A Little Friction Is Fine
Ananthanpillai doesn’t want everything frictionless. “A little bit of friction is okay with me,” he said. “If it’s easy for you, it’s going to be easy for the hacker.”
The internet was built for parties that already trusted each other, he said. That has flipped. “Absolutely verify first and then maybe trust,” he said.
He still bristles at needless collection. His optometrist scans his driver’s license at every visit. “For God’s sake, what the heck are you going to do?” he recalled asking. His wife tells him not to argue with the messenger.
The worry is not abstract. ID scanning firm IDScan confirmed a breach tied to 153 million stolen driver’s licenses, BleepingComputer reported.
He sees regulators moving. In September, five federal agencies said banks may accept mobile driver’s licenses for customer identity checks, American Banker reported. He expects digital tokens to follow.
His closing advice was short. “Don’t have your data PII on your premises if you don’t have to,” he said.
The Trust Crisis, The Book
The Trust Crisis
Ananthanpillai’s book is The Trust Crisis: How Big Tech Stole Your Identity and the New Model That Takes It Back, from Forbes Books. He said he takes no money from it. Every dollar goes to a nonprofit that helps identity theft victims, he said.
FAQ – Digital Trust
What is digital trust?
It is confidence that a person or system online is who it claims to be. Raj Ananthanpillai argues today’s methods build it by copying personal data everywhere.
What is a trust token?
Trua’s reusable credential. A person verifies their details once. Businesses then get verified answers, such as “identity confirmed,” without receiving the underlying records.
Would holding less personal data lower cyber insurance premiums?
Ananthanpillai says it should, by half for firms that hold none. That is his opinion. He offered no pricing data.
How many places hold a person’s Social Security number?
Hundreds, if not thousands, Ananthanpillai says. Each one must protect it.
Why do AI agents raise digital trust concerns?
An autonomous agent may have no verified human behind it. Ananthanpillai says that leaves accountability and liability unclear.
Is Trua’s system hack-proof?
Ananthanpillai says data is encrypted on a blockchain with two keys. He also says no system is 100% foolproof. CINI has not tested Trua’s design.
Full Transcript
Download the full transcript: Cyber Insurance News Podcast With Raj Ananthanpillai, Trua. The transcript is machine-generated and lightly edited. It may contain errors. Please check the audio before quoting.
Related Cyber Insurance Posts
- Could The Plant Run By Hand After A Cyberattack? 40% Don’t Know, SANS Finds
- Sophos And Spektrum Labs Launch FastTrack Program Linking MDR To Cyber Insurance Policy Approval(Opens in a new browser tab)
- Credential Theft Cyber Insurance: What 2.86 Billion Stolen Credentials Mean For Underwriters(Opens in a new browser tab)
- 6lock Puts A Lloyd’s Policy Behind The Wire Transfer(Opens in a new browser tab)