Identiverse 2024 shows passkeys and verification are converging

At a glance

What this is: This is 1Kosmos’s readout from Identiverse 2024, where passkeys, verification, and user experience were presented as converging parts of the same identity problem.

Why it matters: It matters because IAM teams now have to design assurance flows that work across login, recovery, and proofing, not treat authentication and verification as separate programmes.

By the numbers:

• Air New Zealand reported 25% of sign-ins using passkeys and a 30% opt-in rate within the first 24 hours.
• The workshop referenced a 2015 data breach affecting 21.5 million federal workers’ fingerprint data.

Context

Passkeys reduce phishing risk by replacing reusable secrets with device-bound authentication, but they do not solve every identity assurance problem on their own. This Identiverse 2024 recap argues that verification, recovery, and authentication are moving closer together as identity systems face stronger fraud pressure and more fragmented user journeys.

The practical issue for IAM and security teams is that users increasingly experience identity as a single trust flow, even when the back end still splits it into proofing, login, step-up, and account recovery. The article’s examples, from passkey portability to biometric privacy concerns and deepfake-driven verification risk, show that mature programmes must connect these layers rather than optimise each in isolation.

Key questions

Q: How should teams govern passkey adoption across login and recovery flows?

A: Treat passkeys as part of a broader assurance design, not a standalone MFA project. Teams should align enrolment, device transfer, fallback recovery, and step-up policy so users are not forced back into weaker recovery methods when a keychain changes or a device is lost.

Q: Why do deepfakes create more risk than ordinary identity fraud?

A: Deepfakes compress the time needed to impersonate a real person and make the attack look legitimate at the exact moment trust is granted. That means controls built for post-event review or manual judgment often react too late, especially in onboarding, recovery, and high-risk approvals.

Q: What are the signs that fragmented identity verification is creating security gaps?

A: Common signs include teams using different verification standards, onboarding happening faster than fraud review, and compliance checks varying by department. You may also see more exceptions at login, onboarding, and access control points, plus difficulty scaling fraud detection across the enterprise. Those symptoms indicate identity governance is not keeping pace with business-led technology adoption.

Q: Should organisations prioritise phishing-resistant MFA over other identity projects?

A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.

Technical breakdown

Passkey interoperability and multi-device flows

FIDO passkeys are designed to replace shared secrets with asymmetric credentials bound to devices and synced keychains. As the article notes, passkey transfer between 1Password and Dashlane demonstrates that interoperability is becoming a real operational concern, not just a standards discussion. Multi-device support matters because users do not authenticate in a single fixed environment, and programmes that assume one device per account create friction that slows adoption. The technical challenge is less about whether passkeys work and more about whether the surrounding lifecycle, enrolment, backup, and recovery flows remain coherent across devices and providers.

Practical implication: Treat passkey deployment as an ecosystem design problem, not a one-time authentication swap.

Why verification and authentication are converging

Verification asks whether a person or entity can be trusted to claim an identity, while authentication asks whether that same subject can prove possession of an enrolled factor at sign-in. The article reflects a growing market reality: organisations cannot keep these functions isolated when account recovery, step-up checks, and fraud detection all affect the same trust decision. Deepfakes intensify this problem because they can manipulate the evidence used in verification before authentication ever begins. When the proofing layer and the login layer are disconnected, attackers look for the weakest handoff between them.

Practical implication: Align identity proofing, sign-in, and recovery controls around one trust model instead of separate teams and policies.

Deepfakes expose brittle identity proofing assumptions

Deepfakes are not only a media problem, they are an identity assurance problem because they undermine visual or voice-based confidence in who is being verified. The article’s emphasis on repeatedly proving identity across systems shows why static verification checkpoints become fragile when attackers can synthesize convincing evidence. In practice, this shifts the burden toward stronger proofing context, device binding, and risk-aware verification workflows that can resist spoofed input. Identity teams should treat deepfakes as a pressure test for any process that still depends on human judgement alone.

Practical implication: Review proofing and recovery steps that rely on human inspection or one-time evidence.

Threat narrative

Attacker objective: The attacker wants to turn weak verification into unauthorized account access or recovery control without triggering strong authentication resistance.

1. Entry begins when an attacker exploits weak or fragmented identity proofing rather than the authentication factor itself, using impersonation or manipulated evidence to get into the trust process.
2. Escalation occurs when that compromised trust step is reused across systems, allowing the attacker to move from verification failure into account access, recovery abuse, or step-up bypass.
3. Impact follows when users and defenders can no longer distinguish legitimate identity events from fraudulent ones, weakening trust in the entire digital identity flow.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passkey adoption is now a user-experience and governance problem, not just an authentication upgrade. The article shows that interoperability, device transfer, and multi-device support are shaping whether passkeys move beyond pilot use. That means teams need to evaluate the full identity journey, including enrolment, backup, and recovery, rather than measuring success only by login strength. The practitioner implication is that passkeys fail if the surrounding lifecycle remains brittle.

Verification and authentication are converging because users experience identity as one trust flow. Fragmented proofing, sign-in, and recovery models create gaps that attackers exploit and users feel as friction. Once deepfakes enter the picture, the old separation between who you are and how you log in becomes operationally weak. Practitioners should stop treating those controls as separate programmes and start governing them as one assurance chain.

Deepfake pressure exposes the limits of evidence-based identity checks. The article makes clear that identity teams can no longer rely on human recognition, voice, or visual confirmation as stable assurance inputs. That shifts the discipline toward stronger binding between device, factor, and trust context, especially where fraud and account recovery intersect. The practitioner takeaway is to assume synthetic evidence will reach your verification workflows.

Identity assurance is becoming a front door issue for consumer trust. The article’s emphasis on consumer reputation and seamless experiences reflects a broader market shift in which identity programmes influence brand trust as much as security outcomes. For practitioners, this means the architecture has to reduce repeated proofing without lowering assurance. The field is moving toward a model where user trust and security trust are evaluated together.

Named concept: identity assurance convergence. Verification, authentication, and recovery are collapsing into a single operational control surface. That matters because the old assumption that these can be designed separately no longer holds when attackers target the handoff between them. The implication is that identity governance needs shared policy, shared telemetry, and shared ownership across the full trust lifecycle.

What this signals

Identity assurance convergence: passkeys, verification, and recovery are no longer separable workstreams. Security teams should expect the weakest handoff between proofing and authentication to become a primary fraud path, which means governance has to move from isolated controls to a shared trust model.

The practical question for IAM leaders is no longer whether passkeys are viable. It is whether the surrounding identity journey can absorb device changes, recovery events, and fraud pressure without pushing users back to brittle knowledge-based or help-desk mediated steps.

For practitioners

• Unify proofing, login, and recovery governance Map where users are asked to prove identity more than once and remove duplicated checks that do not add assurance. Align ownership so the same policy model governs proofing, step-up, and account recovery decisions.
• Test passkey interoperability before broad rollout Validate enrolment, transfer, and fallback flows across the keychains and platforms your workforce or customer base actually uses. Measure whether users can move between devices without losing access or weakening the authentication model.
• Review recovery paths for deepfake resistance Inspect help-desk, video, voice, and document-based recovery steps for places where synthetic media could impersonate a user. Replace high-trust human judgement with stronger context and binding where recovery is a privileged path.
• Reduce repeated identity proofing across systems Identify redundant verification prompts across apps and business units, then rationalise them into a shared assurance policy. The goal is to preserve trust without training users to expect constant re-verification.

Key takeaways

• Passkeys improve phishing resistance, but their value depends on whether enrolment, transfer, and recovery are governed as one lifecycle.
• The article shows that verification and authentication are converging because repeated proofing and deepfake pressure expose gaps between trust decisions.
• Practitioners should focus on shared assurance policy, stronger recovery controls, and fewer redundant identity checks across systems.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Converged Identity Assurance: Converged identity assurance is a unified model that brings multiple identity controls together instead of leaving them in separate silos. It ties authentication, identity verification, and ongoing assurance into one continuous approach, helping organisations reduce fragmentation, strengthen trust boundaries, and support Zero Trust adoption.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.