Topic starter
10/06/2026 10:38 pm
TL;DR: Fraud and compliance risk can change continuously across the customer lifecycle, and SumSub says its new risk scoring engine recalculates it in real time, with 76% of fraud occurring after onboarding and businesses losing an average of $300,000 per incident in 2024; static review cycles and manual checks struggle to keep pace with behaviour-driven risk.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Sumsub Introduces Risk Scoring to Automate Risk Decisions with Real-time Intelligence”.
By the numbers:
- 76% of fraud occurs after onboarding, during user activities such as transactions, logins, and profile updates.
Key questions
Q: What breaks when customer risk is only assessed at onboarding?
A: Static onboarding checks miss the risk that emerges after a customer becomes active.
Q: When should organisations prioritise automated data risk scoring over manual review workflows?
A: Organisations should prioritise automated scoring when data volumes, cloud sprawl, and regulatory obligations make manual review too slow to keep pace.
Q: What are the signs that lifecycle-only controls are failing?
A: Common signs include repeated post-onboarding fraud, delayed detection after behavioural changes, and review queues that only react after damage is done.
Practitioner guidance
- Rebuild review triggers around behavioural change Tie risk reevaluation to transaction, device, login, and profile-change events so the control reacts after onboarding instead of waiting for periodic review.
- Define and govern weighted signal logic Document which signals count, how they are weighted, and who can change the scoring model so compliance policy stays auditable.
- Separate low-risk automation from escalation thresholds Use the score to route routine cases automatically, but require documented thresholds for medium and high-risk outcomes.
Bottom line: Lifecycle-only controls miss the point where customer risk actually changes, which is often after onboarding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/06/2026 2:44 am
Static onboarding checks are no longer enough to govern risk across the customer lifecycle. The article’s core claim is that fraud commonly appears after the initial identity decision, which means trust cannot be frozen at enrolment. Once behaviour changes during transactions or profile updates, the original risk view becomes stale. For identity teams, the lifecycle itself is the control surface, not just the entry point.
A few things that frame the scale:
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
A question worth separating out:
Q: Who should own risk-scoring decisions across fraud and compliance teams?
A: Ownership should sit across fraud, compliance, and IAM because the score informs all three domains. One team can define policy, but shared governance is needed for thresholds, exceptions, audit trails, and change control. Without that, the same score can trigger inconsistent actions and weaken accountability.
👉 Read our full editorial: Dynamic risk scoring exposes the limits of lifecycle-only controls
12/06/2026 4:18 am
Dynamic scoring exposes the limit of onboarding-centric identity governance: The article describes a control model in which risk is recalculated as behaviour changes, not fixed at the end of verification. That is a direct challenge to programmes that still treat lifecycle checkpoints as the main source of trust. The implication is that customer identity governance now has to absorb event-driven evidence, not just enrolment evidence.
A question worth separating out:
Q: How should compliance teams govern black box risk scoring models?
A: Compliance teams should require explainable decision traces, documented inputs, and a clear override path for every material model outcome. If the organisation cannot reconstruct why a score influenced a decision, the model should not be treated as audit-ready. Governance should focus on evidence quality, reviewability, and recertification triggers, not only on raw performance.
👉 Read our full editorial: Dynamic risk scoring exposes the limits of lifecycle-only controls
This post was modified 2 days ago by NHI Mgmt Group