Federal cybersecurity and modernization leader joins Token’s board of CISOs and government security leaders as cryptographic biometric identity assurance becomes the control point for both human and AI authorization.
Token, the biometric identity assurance company, announced the appointment of Robert Costello to its Industry Advisory Board. The former Chief Information Officer of the Cybersecurity and Infrastructure Security Agency (CISA) and current Chief Digital and Information Officer at Merlin, Costello brings more than two decades of federal cyber, modernization, and mission-technology leadership to a board that guides Token’s response to the threats facing the world’s most critical organizations.
Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX
Former CISA CIO Robert Costello joins Token to help shape the future of identity assurance.
Token’s Industry Advisory Board is composed of senior cybersecurity executives, CISOs, and government security leaders responsible for protecting some of the world’s most critical organizations and infrastructure.
The appointment comes at a defining moment for enterprise security. Credential compromise remains the leading cause of enterprise breaches, and AI has made the problem structurally worse — phishing, deepfakes, and social engineering now operate at machine speed, while the credentials underneath have not fundamentally changed. As enterprises move AI agents from advisory roles into operational workflows, a second question has emerged: who, exactly, approves the high-consequence actions those agents are now capable of taking? Token recently extended its biometric architecture in response to that question, placing hard gates around actions such as releasing funds, changing access rights, or modifying production systems, so that an AI agent can prepare the work, but only a verified, physically present human can approve the outcome.
Token’s cryptographic biometric identity assurance proves the human, not just the credential. Rather than layering factors onto weak credential foundations, Token binds both access and approval to a verified, physically present person through on-device biometric authentication enforced on secure hardware. The TokenCore product line — including the TokenCore Wearable, TokenCore Portable, and TokenCore Node — integrates with existing IAM, SSO, and PAM infrastructure. It does not replace the identity stack; it completes it.
“The CISOs and security leaders on our Industry Advisory Board live with the consequences of identity failure every day, and that perspective is exactly what shapes where we take this technology,” said Kevin Surace, CEO of Token. “Robert has modernized and defended technology at the scale of national infrastructure, under constraints most enterprises never face. As the question shifts from ‘Who logged in?’ to ‘Who approved this action — a human or an agent?’, his judgment is exactly the kind we want guiding us.”
Costello currently serves as Chief Digital and Information Officer at Merlin, where he leads digital strategy, enterprise architecture, artificial intelligence adoption, and secure technology modernization for public sector and critical infrastructure customers. Before joining Merlin, he served as CIO at CISA, where he led major modernization efforts across zero trust, enterprise architecture, cloud adoption, identity management, application modernization, and secure mission technology. His career has also included senior technology roles at Department of Homeland Security components, including Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), as well as private-sector experience supporting federal civilian missions. A U.S. Air Force veteran and CISSP, Costello brings a practitioner’s view of cybersecurity: technology has to work in real environments, under real constraints, for operators who do not have time for theater. His work sits at the intersection of cyber operations, mission enablement, modernization, and technology innovation.
Catch more CIO Insights: What Does “Job-Ready” Really Mean in IT and Cybersecurity?
[To share your insights with us, please write to psen@itechseries.com ]
