1Kosmos funding signals rising demand for verified digital identity

At a glance

What this is: This is a funding announcement that argues verified digital identity is moving into the security perimeter as organisations confront fraud, impersonation and password weakness.

Why it matters: IAM, IGA and PAM teams should treat identity proofing and passwordless authentication as governance controls that shape trust at enrolment and access time, not just login convenience.

Context

Verified digital identity is the trust layer that confirms a person is who they claim to be before access is granted. The issue is no longer limited to onboarding or consumer login. As AI-assisted impersonation, fraud and account takeover intensify, identity proofing is being pulled into core IAM architecture.

This article uses 1Kosmos's funding round to argue that the market is revaluing verified identity as a perimeter control. The governance question for practitioners is whether their current identity programme can still distinguish a legitimate user from a convincing digital impostor at the point of access.

Key questions

Q: How should IAM teams use identity proofing in high-risk access flows?

A: Treat identity proofing as an upstream trust signal that must influence later access decisions, not a one-time onboarding checkbox. High-risk access should require proofing assurance, authentication strength, and policy enforcement to line up so the organisation can reject weakly established identities before they reach sensitive systems.

Q: Why do passwordless systems still need identity governance?

A: Passwordless systems still need identity governance because authentication strength does not answer lifecycle questions. Teams still need to decide who can enrol devices, how to revoke lost authenticators, how to prove ownership during recovery, and when fallback access is acceptable. Strong login technology without governance often produces hidden exceptions that are hard to audit.

Q: What breaks when identity assurance is not propagated into access policy?

A: The proofing decision becomes a dead signal. A user may be verified at enrolment, then later receive privileges or access paths that do not reflect that original assurance level. That creates a governance gap where trust is created once but never enforced again.

Q: How should financial services teams balance identity verification security with user experience?

A: Use risk-based verification so low-risk users pass quickly while higher-risk cases trigger stronger document, biometric, or manual review steps. The goal is not to remove friction everywhere, but to place friction where it changes risk. Track abandonment, fraud rates, and exception handling together so you can see whether the flow is protecting both conversion and trust.

Technical breakdown

Identity proofing now sits inside the access decision

Identity proofing establishes confidence in a subject before credentials are issued or access is approved. In practice, that means proofing signals, assurance level, and authentication strength are no longer separate concerns. When an organisation treats proofing as an upstream, standalone process, attackers can exploit the gap between identity enrolment and later access use. That gap becomes more dangerous when the user experience is expected to remain low-friction. For IAM architects, the relevant design question is how assurance moves with the identity through its lifecycle.

Practical implication: Tie proofing assurance to downstream access policy so that the original trust level continues to matter at authentication and authorisation time.

Passwordless authentication changes the attack surface, not the governance burden

Passwordless methods reduce phishing exposure and credential reuse, but they do not remove identity governance requirements. The control problem shifts from password hygiene to assurance over the binding between a person, a device, and the authenticator. If that binding is weak, the access path can still be abused even when no password exists. This matters especially where external identities, partner access, or regulated workflows require higher confidence than consumer-grade authentication can provide. Passwordless is therefore a trust architecture decision, not a cosmetic login change.

Practical implication: Review whether your passwordless rollout actually strengthens identity assurance or simply moves the weak point to device and authenticator binding.

AI-driven impersonation makes verified identity a perimeter control

The article's strongest signal is that AI is increasing the realism and scale of identity fraud. When synthetic voices, image manipulation, and automated social engineering can imitate legitimate users more convincingly, traditional identity checks lose discriminating power. That pushes verified digital identity closer to the perimeter because the first access decision becomes the most important one. This is why identity proofing, authentication, and fraud resistance are converging into a single governance domain. For security leaders, the question is no longer whether identity is part of the perimeter, but how much of the perimeter depends on it.

Practical implication: Assume impersonation is a live access threat and validate whether your identity controls can resist AI-assisted fraud before issuing access.

NHI Mgmt Group analysis

Verified identity is becoming the new trust boundary for access governance. When passwords become easier to replay, phish, or socially engineer, the point of assurance shifts to identity proofing and strong authentication. That changes the job of IAM from credential administration to trust establishment across the identity lifecycle. Practitioners should treat verified identity as a foundational access control, not an adjacent onboarding step.

Passwordless programmes only reduce risk when the underlying assurance model is sound. A passwordless flow can still fail if device binding, authenticator binding, or enrolment assurance is weak. The market often talks about user friction, but the governance issue is whether the access path actually proves the right person at the right assurance level. Security teams should read passwordless as a control architecture problem, not a UI upgrade.

AI fraud pressure is collapsing the distance between identity verification and fraud prevention. As synthetic impersonation improves, organisations can no longer assume that a successful login means a legitimate actor. That is especially important for external identities, regulated transactions, and high-risk workforce access. The implication is that identity security and fraud controls are converging around the same trust problem.

Identity proofing and access governance are now inseparable in modern IAM programmes. A proofing decision that is not enforced downstream becomes an ungoverned signal. This is where many identity programmes remain fragmented: they verify once, then let the assurance context evaporate. Practitioners should design for continuous trust propagation, not one-time enrolment confidence.

The funding signal matters because capital is following verification, not just authentication. The market is telling practitioners that identity security is moving upstream into who can be trusted before they can authenticate. That should push IAM, IGA, and PAM teams to re-evaluate where assurance is created, how it is preserved, and which identities require stronger evidence than a standard login can provide.

What this signals

Verified identity is moving from a niche onboarding control to a core trust primitive. IAM programmes that still separate proofing, authentication and authorisation will struggle to explain where assurance actually lives. The practical shift is to govern identity evidence across the full access path, not just at the first login.

AI-assisted impersonation raises the value of stronger enrolment and binding checks. When the attacker can convincingly imitate a legitimate user, the question becomes whether the organisation can prove continuity between the claimed identity, the device and the authenticating factor. That is now a programme design issue, not an edge case.

Passwordless adoption should be judged by assurance quality, not by friction reduction alone. A simpler login that leaves enrolment weak or privileged access under-governed simply relocates risk rather than reducing it.

For practitioners

• Define assurance tiers for verified identity Map user populations, transaction types, and access paths to explicit assurance levels so proofing strength matches business risk.
• Bind authentication to enrolment confidence Ensure the access policy consumes proofing outcomes, so a weak enrolment cannot later receive high-risk privileges without re-verification.
• Stress-test impersonation resistance Evaluate whether synthetic voice, deepfake, and social engineering scenarios can bypass your current identity checks and step-up controls.
• Separate low-friction login from high-trust access Use passwordless methods where they fit, but require stronger evidence for privileged, external, or regulated workflows.

Key takeaways

• Verified digital identity is becoming a governance issue for IAM teams because weak proofing and weak authentication now create the same trust problem.
• The funding round reflects a broader market shift toward stronger identity assurance as AI-driven impersonation and fraud erode confidence in login alone.
• Practitioners should align proofing, authentication and downstream access policy so that verified identity remains meaningful beyond enrolment.

Key terms

• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Reusable Digital Identity: Reusable digital identity is a model where verified attributes or credentials can be presented across multiple services without repeating the full proofing process. It improves usability, but it also requires strict rules for freshness, scope, and revocation so one stale assertion does not become widely trusted.
• Assurance Level: An assurance level is the degree of confidence an organisation has that an identity proofing or authentication outcome is accurate. Higher assurance usually means stronger checks, more evidence, and more governance overhead. The key is matching assurance to the transaction risk, not applying one standard everywhere.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.