Identity verification is overtaking passwordless as AI risk grows

At a glance

What this is: NHI Mgmt Group's analysis, drawing on HYPR's research: AI-driven impersonation has become a larger identity risk than stolen credentials, while passwordless adoption continues to stall.

Why it matters: IAM, IGA, and security teams need to treat identity verification as a lifecycle control, not just an authentication layer, because AI now scales impersonation faster than manual review can respond.

Context

Identity verification is now being positioned as a lifecycle control because the threat landscape has moved beyond stolen passwords and toward AI-enabled impersonation. In practical terms, the question is no longer whether organisations can make login harder, but whether they can still trust the person or system behind the identity request.

HYPR’s report frames this as a literacy-action gap: technical awareness has improved, yet adoption still lags. That gap matters to programmes spanning human IAM, fraud controls, and adjacent NHI governance because the same trust assumptions break when synthetic media, automated phishing, and delegated access are used together.

For identity teams, the core issue is assurance drift. The control surface has moved from the sign-in moment to onboarding, step-up verification, and ongoing identity proofing across the lifecycle.

Key questions

Q: How should organisations handle impersonation risk when passwordless adoption stalls?

A: They should treat passwordless as one control layer and add stronger identity verification around enrollment, recovery, and high-risk changes. That combination reduces credential theft without assuming the login method alone can prove identity. Organisations also need to harden help desk and delegation workflows, because attackers increasingly exploit the process around authentication rather than the password itself.

Q: Why are AI deepfakes a problem for identity verification?

A: AI deepfakes weaken verification because they make voice and video far less reliable as identity signals. If a helpdesk or operations team depends on a believable conversation, an attacker can impersonate authority without breaking technical controls. The answer is to shift verification toward independent proof, not human confidence.

Q: What are the signs that an identity assurance programme is not working?

A: Common warning signs include multiple MFA tools with no clear consolidation path, manual employee verification, disconnected onboarding processes, and poor visibility into identity metrics. If teams cannot track assurance consistently across the lifecycle, security and business friction rise together. That usually means identity trust is still being handled as isolated tasks rather than one control plane.

Q: Should teams use passkeys, identity verification, or both?

A: They should use both, but for different jobs. Passkeys reduce phishing and password theft at authentication time, while identity verification raises confidence in the person behind the request. Organisations that want durable assurance need both secure sign-in and stronger lifecycle verification, not a single control used as a catch-all.

Technical breakdown

Why passwordless alone no longer closes the trust gap

Passwordless reduces password reuse, phishing exposure, and credential theft, but it does not by itself prove that the requester is the legitimate identity holder. Identity verification adds a higher-assurance layer by checking evidence at issuance or step-up points, which is why it is increasingly used alongside passkeys rather than as a replacement for them. In mixed environments, passwordless secures the authentication event while verification secures the identity claim. That distinction matters when attackers can use synthetic voice, video, or automated social engineering to reach help desks, onboarding flows, or recovery paths.

Practical implication: Treat passwordless as one control in a broader assurance stack, not as a complete answer to impersonation risk.

How AI changes the economics of impersonation

AI lowers the cost of producing convincing lures, cloned voices, and fabricated video at scale, which changes impersonation from a targeted exception into an industrialised attack pattern. The report’s figures on deepfake exposure and AI concern point to a shift in attacker economics: more attempts, lower effort, faster iteration, and less dependence on stolen credentials. That means defenders must assume that identity requests can be fabricated plausibly enough to bypass human judgement, especially in service desks, onboarding, and financial approval chains. The security problem is no longer only authentication strength, but the reliability of the surrounding trust process.

Practical implication: Reassess every human-mediated identity workflow that still assumes visual, vocal, or contextual trust is sufficient.

Why lifecycle assurance matters more than point-in-time login controls

Point-in-time login controls only protect one moment in the identity journey. The article’s emphasis on onboarding to offboarding shows why assurance now has to follow the identity across issuance, recovery, privilege changes, and retirement. That is especially relevant where human identity processes intersect with NHI lifecycle governance, because delegated access, recovery channels, and service approvals often inherit the same trust assumptions. If identity proofing is weak at any stage, attackers can exploit the process even when the authentication method itself is modern. The result is a governance gap, not just an authentication gap.

Practical implication: Extend assurance controls into enrollment, recovery, and offboarding rather than measuring success only at login.

Threat narrative

Attacker objective: The attacker aims to obtain trusted access by convincing the organisation to verify the wrong identity and then exploiting that trust for fraud or data theft.

1. Entry begins with impersonation through personalised phishing, synthetic voice, or deepfake video that targets identity workflows rather than passwords alone.
2. Credential or identity access is obtained when help desks, onboarding teams, or recovery processes accept a plausible but false identity claim.
3. Impact follows when the attacker uses that false assurance to escalate trust, harvest data, or move into privileged processes before manual review catches up.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity verification is becoming a governance control, not just an authentication control. Passwordless adoption reduces friction and shrinks some credential risk, but it does not answer whether the requester is genuine. As AI scales impersonation, identity assurance has to move into enrollment, recovery, and lifecycle governance. The practitioner implication is that IAM teams must measure assurance quality across the full identity journey, not only at sign-in.

Industrialised impersonation is exposing the limits of human judgement in identity workflows. Deepfakes, cloned voices, and personalised phishing convert a trust decision into a high-volume attack surface. That breaks the old assumption that a trained reviewer can reliably distinguish legitimate requests from synthetic ones. The implication is that organisations need stronger evidence-backed verification paths wherever people currently make identity decisions by instinct.

Identity assurance is now a cross-domain problem that spans human IAM and NHI governance. The same lifecycle logic that governs service accounts also applies to humans when attackers exploit onboarding, recovery, or delegated access. This is where identity verification becomes part of broader trust architecture, not a separate product category. The implication is that programmes should align proofing, recovery, and offboarding controls across all identity types.

Assurance drift is the named risk hidden inside passwordless stall. The report shows awareness rising faster than adoption, which means organisations understand the threat but have not yet re-engineered the workflow. That gap matters because the attacker only needs one weak trust path, while defenders often modernise only the login layer. The implication is that maturity should be measured by how well verification travels across the lifecycle.

Identity verification must be treated as continuous evidence handling. In a high-AI environment, the issue is not only whether a factor is phishing-resistant but whether the identity proof remains trustworthy when context changes. That pushes programmes toward step-up verification, recovery hardening, and tighter governance over who can vouch for identity claims. The implication is that static trust assumptions will keep failing under synthetic attack pressure.

From our research library:

• Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.

What this signals

Assurance has shifted from credential strength to trust validation. Security teams should expect more scrutiny on whether identity workflows can withstand synthetic voice, video, and AI-assisted social engineering. The practical signal is clear: if recovery or onboarding still depends on human recognition, the process is already behind the threat.

Identity verification will increasingly sit inside broader identity lifecycle governance. That means IAM leaders need to think beyond authentication and re-examine who can attest, restore, or reissue trust after a request. Programmes that only modernise sign-in will keep absorbing risk at the edges of the lifecycle.

For practitioners

• Strengthen identity proofing at enrollment Require higher-assurance proofing for new accounts, recovery requests, and role changes so identity trust is established before access is granted.
• Harden recovery and help desk workflows Replace knowledge-based or human-recognition checks with verifiable evidence, especially where voice, video, or social engineering can be used to impersonate users.
• Extend verification into offboarding and re-verification Re-check identity trust when users change role, regain access, or return from inactivity so assurance does not decay after initial onboarding.
• Align passwordless with step-up assurance Use passkeys to reduce credential theft, but pair them with step-up verification for recovery, high-risk actions, and account changes.

Key takeaways

• AI-driven impersonation is now competing with stolen credentials as a leading identity risk, which changes what IAM teams must defend.
• Passwordless can reduce credential theft, but it does not by itself prove that a requester is genuine across the full lifecycle.
• The control gap is moving toward onboarding, recovery, and offboarding, where identity verification has to do more of the assurance work.

Key terms

• Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
• Impersonation: Impersonation is a controlled administrative action that lets an authorised operator assume a user context for debugging or support. In a well-governed setup it preserves audit logging, limits exposure of credentials, and keeps production authentication separate from local troubleshooting.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.