TL;DR: Billions of records breached each year and rising regulatory pressure have made username-password authentication inadequate for digital environments, according to Daon, while digital identity uses cryptographic credentials, biometrics and selective disclosure to verify attributes without exposing unnecessary personal data. The governance shift is from static login assurance to governed proof, privacy minimisation and contextual trust.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Daon's blog post: Digital identity is moving trust away from passwords and toward cryptographic proof, biometric verification and selective disclosure.
Why it matters: IAM, identity verification and privacy teams need to treat digital identity as a governance model, not just a login method, because the control boundaries now span proofing, disclosure and consent.
Context
Digital identity is the set of electronically captured attributes, credentials and verification mechanisms used to represent a person, organisation or device in digital systems. The governance problem is that legacy username-password models were never designed to prove attributes safely, minimise disclosure or preserve trust across many different services.
This matters because the identity layer now carries privacy, fraud and compliance obligations at the same time. Identity data privacy and consent becomes central when organisations collect only the attributes needed for a transaction and must still manage revocation, retention and lawful sharing.
The subject here is not whether digital identity is useful in principle. The issue is whether existing identity and access programmes can support proofing, biometric use and selective disclosure without recreating the same exposure patterns that passwords and scanned documents created.
Key questions
Q: How can security teams decide whether a digital identity flow is high assurance enough?
A: Judge it by the strength of the binding between the credential, the device, and the account recovery path. A flow is high assurance only if the verifier can trust the underlying issuance, the wallet can prove possession, and the system prevents takeover during sensitive lifecycle events. If any of those links is weak, assurance is incomplete.
Q: What is the best way to minimise identity data in verification flows?
A: The best way is to collect only the attributes needed for the specific verification decision, then avoid storing raw documents or full profile data unless a control requires it. Use purpose-limited data fields, selective disclosure, tokenisation where suitable, and short retention periods. Where data must be shared, limit retention and define lawful sharing with the relying party.
Q: Why can biometric authentication reduce password-related friction without eliminating identity risk?
A: Biometrics can remove the burden of remembering passwords or codes, which improves convenience and may raise adoption. But the risk does not disappear, because authentication still depends on secure capture, reliable matching, and trustworthy enrollment. If those controls are weak, a biometric can become just another high-value credential path that attackers target rather than a complete replacement for passwords.
Q: How should organisations govern selective disclosure in digital identity systems?
A: They should define which attributes are allowed for each transaction type, who can request them, and how consent is recorded and revoked. Selective disclosure only reduces risk when the disclosure scope is enforceable and auditable. Without that governance, wallets and attribute services can still expose more identity data than the use case needs.
Technical breakdown
How cryptographic digital identity changes trust establishment
Digital identity replaces simple shared secrets with verifiable claims anchored in cryptography. A credential can be checked without revealing the underlying secret, which changes the assurance model from “do you know the password?” to “can the issuer and verifier establish that this claim is valid?” That matters because trust can be separated from broad data exposure. The same design also supports device-bound keys and signed assertions, which are harder to replay than password-based logins. See the Verifiable Credentials Guide.
Practical implication: Map your highest-risk logins to credential-based assurance rather than password strength alone.
Why biometric authentication needs stronger governance than convenience features
Biometrics add a recognition factor, but they also introduce permanence, privacy and spoofing concerns that passwords do not create. A biometric signal is not a password replacement by default. It is a proofing and authentication factor that must be evaluated for template storage, liveness detection, presentation attack resistance and fallback pathways. If the biometric pipeline is weak, the organisation has simply moved the trust problem from a memorised secret to a harder-to-revoke body-based signal. See the Biometric Authentication and Verification Guide.
Practical implication: Treat biometric enrollment, template protection and spoof detection as governed controls, not user-experience settings.
Selective disclosure reduces over-collection but not governance responsibility
Selective disclosure lets a relying party verify a specific attribute, such as age or role, without collecting the full identity record. That changes data handling materially because the verifier no longer needs the entire profile to make a decision. However, selective disclosure is not the same as blanket anonymity. The organisation still has to govern which attributes are requested, how disclosure is bound to purpose, and how records are retained or shared after verification.
Practical implication: Define attribute-minimisation rules before deploying selective disclosure into customer or workforce journeys.
Threat narrative
Attacker objective: The objective is to impersonate users or abuse identity workflows well enough to access accounts, data or regulated services.
- Entry occurs when attackers exploit weak password-based authentication, breached records or forged identity inputs to get into digital identity flows.
- Credential access follows when stolen usernames, passwords or uploaded identity documents are reused, replayed or socially engineered across services.
- Impact comes when trust decisions are made on incomplete verification, exposing personal data, enabling fraud and undermining confidence in the identity layer.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Password-centric identity is now a weak trust primitive: Digital identity programmes are being built to replace a model that cannot prove attributes, limit disclosure or withstand reuse at scale. Once identity proofing, credential issuance and verification are separated, the governance job shifts from password policy to assurance design. Practitioners should stop treating authentication as the whole identity problem.
Selective disclosure is a governance control, not a privacy slogan: The real value is that a verifier can receive only the attribute needed for a decision. That reduces unnecessary data movement, but only if requests, storage and retention are all designed around the minimum viable claim. Teams that use selective disclosure without purpose limits will still accumulate privacy debt.
Biometric trust depends on revocability of the surrounding system, not the body signal itself: A biometric factor can improve convenience, but the surrounding enrollment, storage and anti-spoof controls determine whether it is actually trustworthy. Because biometric data is not replaceable in the way a password is, the control burden shifts to template protection, liveness checks and recovery paths.
Digital identity failures increasingly create cross-domain risk: The same identity workflow now touches fraud prevention, privacy law, customer trust and access governance. That means IAM, privacy and security teams can no longer operate as separate reviewers of the same transaction. The practical implication is that identity assurance must be governed as a shared control plane, not a narrow login function.
Read next: NIST SP 800-63 Digital Identity Guidelines Guide
What this signals
Attribute-based trust will matter more than account-based trust: As digital identity matures, practitioners should expect more decisions to be made on the basis of verified claims rather than static account ownership. That changes how access, privacy and fraud controls are designed because the system must evaluate the claim, not just the login session.
The next governance question is who is allowed to request which attributes, under what purpose and with what auditability. That is where identity assurance, consent and retention become one operating model instead of three separate projects.
Organizations that keep adding identity features without reworking lifecycle governance will create new trust surfaces faster than they reduce risk. The practical test is whether the programme can prove less, store less and still make the same decision with confidence.
For practitioners
- Define assurance levels by use case Classify which transactions need low, medium or high assurance and tie each class to proofing, authentication and recovery requirements rather than using one login pattern for everything.
- Minimise the identity data collected Collect only the attributes required for the decision, then set retention and sharing rules that prevent unnecessary persistence of identity data across systems.
- Harden biometric enrollment and verification Use liveness detection, template protection and device-bound verification so biometric factors are not treated as standalone proof of identity.
- Design selective disclosure around the decision Require product and governance owners to specify which attributes can be disclosed, who can request them and what evidence must be retained for audit purposes.
Key takeaways
- Digital identity shifts the trust problem from memorised secrets to verifiable claims, which changes how authentication and proofing should be governed.
- Selective disclosure and biometric verification can reduce unnecessary data exposure, but only when the surrounding controls are designed for minimisation and revocation.
- IAM teams should align assurance, privacy and fraud controls around the transaction being decided, not around a generic login pattern.
Related NHI Mgmt Group resources: Identity Data Privacy and Consent Guide · Verifiable Credentials Guide · NIST SP 800-63 Digital Identity Guidelines Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST CSF 2.0 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Digital identity proofing and credential issuance are central to the article's trust model. |
| SP 800-63B — Authentication | The article argues that passwords are inadequate and stronger authenticators are needed. | |
| SP 800-63C — Federation | Federated identity and cross-organisation verification are discussed as key identity patterns. | |
| Recommendation — Align proofing flows with SP 800-63A and separate evidence collection from authentication decisions. Use SP 800-63B to map authenticator strength to transaction risk and recovery needs. Apply SP 800-63C when identity assertions must travel securely across relying parties. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Digital identity changes how access decisions are made and governed across services. |
| Recommendation — Tie identity assurance to authorization decisions instead of relying on static account trust. | ||
| GDPR | Art.5 — Principles relating to processing of personal data | Selective disclosure, minimisation and consent are core themes in the article's privacy discussion. |
| Recommendation — Design identity flows to minimise personal data collection and retention under Article 5 principles. | ||
Key terms
- Digital Identity: Digital identity is the set of attributes, credentials, and access relationships used to authenticate and authorize a person, service, workload, or automated system. In security operations, it becomes the control layer that determines what can act, where it can go, and how far compromise can spread.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Selective Disclosure: Selective disclosure is the practice of sharing only the identity attributes needed for a specific decision. In credential-based systems, it reduces oversharing, lowers retention burden, and limits exposure when a verifier does not need the full record to make a trustworthy judgment.
- Biometric Authentication: Biometric authentication verifies a person using physical traits such as a fingerprint, face, iris, or voice pattern. It can reduce password use, but it is not a revocable secret in the same way a password is. Security teams must therefore pair biometrics with fallback controls, attestation, and recovery safeguards.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org