AI-assisted identity flows are reshaping fraud and access management

At a glance

What this is: Transmit Security’s 2025 Mosaic Rewind argues that AI-assisted identity flows are moving fraud and access management from static, single-session decisions to continuously adapting control planes.

Why it matters: This matters because IAM, fraud and non-human identity programmes increasingly have to govern adaptive journeys, AI-assisted decisioning and automated activity without losing trust, auditability or control boundary clarity.

Context

Identity security is moving away from fixed, linear flows toward systems that adjust based on behaviour, context and evolving threat patterns. In this article, Transmit Security frames that shift through AI-assisted identity journeys, multi-session fraud analysis, facial authentication and visibility into computer-using agents.

For IAM teams, the governance problem is no longer just whether a user can authenticate. It is whether the identity flow can interpret repeated signals, distinguish human from automated activity, and apply controls consistently across sessions, channels and integrations.

Key questions

Q: How should IAM teams govern AI-assisted identity workflows?

A: Treat AI-assisted identity workflows as governed control paths, not simple productivity tools. Define which tasks the assistant may recommend, draft, or execute, then keep approval rights and exception handling with named humans. The essential control is traceability, so every machine-generated action can be reviewed, challenged, and linked back to a responsible operator.

Q: Why do multi-session fraud signals matter more than single-event checks?

A: Single-event checks miss repeated patterns that only become obvious across time, such as reused selfies, shared biometrics or coordinated synthetic identities. Multi-session analysis lets teams connect those weak signals into a fraud pattern, which improves detection quality and reduces reliance on one-off verification outcomes.

Q: What breaks when non-human identities rely on standing access in automation workflows?

A: Standing access breaks the security model in two ways. First, it expands the number of systems reachable if a credential is stolen. Second, it makes automation harder to govern because the same identity can keep working outside its intended task. The result is broader data exposure, weaker auditability, and more difficult incident containment when cloud or DevOps workflows are compromised.

Q: How can security teams balance frictionless authentication with fraud prevention across web, mobile, and call center channels?

A: They should design authentication as a continuous journey, not a single login event. That means aligning identity proofing, risk scoring, and channel-specific controls so the same user can move across devices and support channels without redoing every step. The goal is to reduce abandonment while preserving enough assurance to block account takeover attempts.

Technical breakdown

AI-assisted identity journeys and adaptive control logic

AI-assisted identity flows use model-guided orchestration to change the next step in a journey based on the signals already collected. In this pattern, the system is not merely authenticating a user once. It is evaluating intent, risk and signal quality across a sequence of interactions, then adjusting friction, verification strength or routing accordingly. That makes the identity layer behave more like a control plane than a point control. The architectural consequence is that governance has to account for how decisions are produced, not only for whether a control exists.

Practical implication: Treat adaptive identity flows as governed decision systems, not just authentication journeys.

Multi-session fraud detection across repeated verification events

Multi-session detection looks beyond one login or one verification attempt and instead compares signals across multiple sessions. That matters because sophisticated fraud often reuses the same biometric traits, behavioural patterns or synthetic media indicators across attempts that look innocuous in isolation. By correlating similarity over time, the platform can spot patterns such as repeated selfie reuse or related synthetic identities that single-session analysis might miss. This is a shift from transaction-level screening to pattern-level fraud intelligence, which raises the bar for evidence retention and cross-session linkage.

Practical implication: Correlate verification signals over time so fraud review is based on patterns, not isolated events.

Facial biometrics and computer-using agent visibility in identity flows

Facial biometrics extend identity assurance into the live authentication path, while enhanced visibility for computer-using agents separates human interaction from automated activity. Those two capabilities address different control questions. Facial recognition supports stronger user verification in orchestrated flows. CUA visibility, by contrast, helps organisations understand when automated software is operating inside what previously looked like a human session. Together they show that identity assurance now has to distinguish both who is present and what kind of actor is driving the interaction.

Practical implication: Separate human authentication controls from automation-detection controls so policy matches the actor actually using the flow.

Threat narrative

Attacker objective: The attacker aims to move through identity checks in a way that creates trusted access or fraudulent account acceptance while avoiding single-session detection.

1. Entry begins with repeated verification attempts that individually appear normal but are linked by shared biometric or behavioural traits across sessions.
2. Escalation occurs when synthetic identities, manipulated media or automated agents reuse those traits to pass controls that only evaluate one session at a time.
3. Impact is a fraud and access environment that allows more convincing impersonation, weaker signal quality and reduced confidence in human versus automated activity.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Adaptive identity flows are becoming a governance problem, not just a product capability. Once identity decisions are influenced by model-driven analysis, practitioners have to care about decision traceability, boundary conditions and override logic. The control is no longer simply 'authenticate' or 'deny'; it is how the system adapts without making the access policy opaque. Teams should treat adaptive flow design as an identity governance issue.

Multi-session fraud detection exposes the limits of event-by-event assurance. Fraud and abuse increasingly unfold across repeated interactions, not a single obvious compromise. That means the governance model must move from isolated verification outcomes to durable signal correlation, or the most important pattern will remain invisible. Practitioners need assurance models that assume repetition, not one-off abuse.

Computer-using agent visibility is an access-management boundary issue. Human IAM controls assume a person is the actor, but automated interfaces can now operate inside the same user-facing flow. That breaks a long-standing operational assumption: the visible session is not always the real operator. Identity programmes need sharper separation between user assurance, automation detection and delegated execution paths.

FAPI 2.0 and integration breadth point to a wider convergence between identity, fraud and regulated access. The market is moving toward identity systems that must satisfy both security engineering and regulated interoperability requirements. That convergence will reward organisations that can govern standards, integrations and flow logic together rather than as separate teams. The practitioner takeaway is to align fraud controls, access controls and standards readiness in one operating model.

Identity assurance is shifting from static proof to continuous interpretation. The combination of AI assistance, facial biometrics and cross-session analysis changes the shape of trust itself. Organisations are being pushed toward identity models that interpret context over time instead of accepting a single proof event as sufficient. Practitioners should expect policy, evidence and workflow design to converge.

What this signals

Identity flows are becoming adaptive control systems. That changes the operating model for IAM teams because the next step in a journey may be determined by behaviour, not by a fixed rule tree. Governance now has to cover model inputs, decision paths and auditability, not just authentication outcomes.

Cross-session correlation is the real fraud boundary. Once abuse can be spread across multiple verification events, teams need evidence models that preserve linkage across sessions and channels. Practitioners should expect the fraud function and IAM function to share more of the same telemetry and policy logic.

Human assurance and automation detection are converging but not interchangeable. Facial biometrics can strengthen user verification, while CUA visibility addresses a different problem: whether software is operating inside the session. The practical task is to keep those control objectives separate even when they sit in the same identity flow.

For practitioners

• Govern adaptive identity decisions Document when AI-assisted flow logic may change the next authentication step, and require review of the signals and thresholds that trigger those changes.
• Correlate fraud signals across sessions Link biometric similarity, behavioural patterns and document traits across multiple verification events so repeated abuse is visible as one pattern.
• Separate human and automated actors Add explicit controls that distinguish a human user from a computer-using agent inside the same journey, especially where authentication and step-up logic share the same path.
• Validate standards and integration boundaries Check that regulated identity flows, third-party integrations and custom connections preserve the assurance properties needed for high-risk access paths.

Key takeaways

• AI-assisted identity flows turn authentication into a continuously adapting control plane, which raises the governance burden on IAM and fraud teams.
• Multi-session fraud detection matters because repeated abuse often hides inside isolated verification events that look normal on their own.
• Practitioners need clearer separation between human assurance, automated activity detection and standards-based access paths.

Key terms

• Adaptive Identity: An identity governance approach that changes access decisions as context changes. Instead of relying only on fixed review cycles, it uses current risk, role, behaviour, and application sensitivity to decide whether access should continue, be reduced, or be revoked.
• Multi-Session Fraud Detection: A fraud control that evaluates patterns across repeated interactions rather than judging each login or verification in isolation. It helps expose synthetic identities, reused biometrics and coordinated abuse that only becomes visible when session data is linked over time.
• Computer-use agent: An AI system that can observe a user interface and take actions across software on behalf of a task. In practice, it extends identity governance beyond API access because the agent can navigate live applications, combine steps, and adapt to changing state during the session.
• Facial Biometrics: Facial biometrics use facial features to confirm or verify a person’s identity. In healthcare, the control is most useful when it is tied to a specific workflow such as patient check-in, clinician access, or account recovery, with clear exception handling and privacy safeguards.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.