How can organisations make identity proofing more resilient to synthetic media?

Organisations should make identity proofing risk-based, layered, and auditable. Use multiple signals, define response thresholds for each protected action, limit repeated attempts, and keep a trace of why each decision was made so the process can be reviewed and improved over time.

Why This Matters for Security Teams

synthetic media changes identity proofing from a one-time verification problem into a moving target. Deepfakes, voice clones, and AI-generated documents can defeat controls that were designed to compare a person against a static reference. That means the real question is not whether a face matches, but whether the proofing process can resist spoofing under adversarial conditions and still leave a defensible audit trail. NIST’s SP 800-53 Rev 5 Security and Privacy Controls is useful here because it frames identity-related controls as a combination of authentication, monitoring, and accountability rather than a single check. In NHI Management Group research, the Ultimate Guide to NHIs notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a reminder that weak proofing and weak identity governance often lead to the same outcome: unauthorized access. In practice, many security teams discover the gap only after an impersonation attempt has already passed an overconfident verification flow.

How It Works in Practice

Resilient identity proofing is layered, risk-based, and designed to fail safely. The strongest programs do not rely on a single biometric, document scan, or knowledge-based question. They combine multiple signals and raise or lower the proofing burden based on the action being requested, the user’s history, the device posture, and the anomaly profile of the session. That approach aligns with the direction in 52 NHI Breaches Analysis, where repeated credential misuse and weak verification controls show how attackers exploit predictable processes. It also fits NIST guidance in SP 800-53 Rev 5 Security and Privacy Controls, especially where authentication, auditability, and fraud detection intersect.

A practical design usually includes:

• Step-up proofing for high-risk actions such as account recovery, payment changes, or privileged role assignment.
• Rate limits and attempt thresholds to prevent adversaries from iterating against liveness checks or knowledge prompts.
• Independent signal sources, such as device binding, phone reputation, session history, and manual review for edge cases.
• Decision logging that records what evidence was presented, what risk score was calculated, and why the outcome was accepted or rejected.

The key operational shift is to treat proofing as a decision pipeline, not a gate. A strong first factor does not end the process if the context is suspicious, and a failed biometric does not automatically block every path if an alternate review flow is available. This is where auditability matters: the organization must be able to explain why an identity was accepted, rejected, or escalated. These controls tend to break down when proofing is outsourced to a single vendor black box because the organisation loses visibility into the signals, thresholds, and failure modes.

Common Variations and Edge Cases

Tighter identity proofing often increases user friction and review workload, requiring organisations to balance fraud resistance against service continuity. That tradeoff is especially visible for remote onboarding, high-volume consumer flows, and emergency access scenarios, where overly strict checks can create operational bottlenecks. Current guidance suggests that there is no universal standard for synthetic media resistance yet, so organisations should calibrate controls to the sensitivity of the action rather than applying one proofing level everywhere.

Some edge cases deserve special handling. Deepfake-resistant proofing may work well for routine enrollment but still fail against coordinated social engineering plus stolen device context. Conversely, manual review can catch more anomalies, but it is slower and itself vulnerable to reviewer fatigue and bias. For higher-risk environments, pair proofing with broader governance from the Top 10 NHI Issues, because identity assurance weakens quickly when secrets, recovery channels, and privileged workflows are not equally controlled. In practice, the best results come from designing proofing as one control in a larger trust chain, not as proof that a real person is definitely present.

Related resources from NHI Mgmt Group

• Why do weak identity controls make fast vulnerability exploitation worse?
• When does a machine identity become a compliance problem?
• Why is it important to integrate identity and data governance?
• How should security teams make NHI best practices usable across the business?