Topic starter
24/06/2026 9:57 pm
TL;DR: Biometrics and passkeys can reduce password-driven account takeover, but they still often prove device possession or prior enrolment rather than the person behind the session, according to 1Kosmos. Identity-backed authentication only closes that gap when liveness, verification, and assurance are bound together.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Possession Is Nine-Tenths of the Flaw: Why Device-based Biometrics Don't Cut It for IAM”.
Key questions
Q: How should security teams handle biometric authentication when identity proofing is weak?
A: Treat the biometric as one factor in a broader assurance chain, not as proof of identity on its own.
Q: What breaks when biometric verification is not tied to device possession and transaction context?
A: Without device possession and transaction context, biometrics can become a weak proof of intent.
Q: Why do liveness checks matter in passwordless authentication?
A: Liveness checks make it harder to use photos, videos, masks or replayed samples as substitute biometrics.
Practitioner guidance
- Tighten enrollment assurance Treat biometric login as the end of a controlled assurance chain.
- Require liveness at step-up Use liveness detection wherever a biometric is expected to carry meaningful access assurance, especially for enrolment, account recovery and high-risk transactions.
- Separate possession from proof Classify device possession, enrolled biometric and verified identity as distinct control states in IAM policy so audit teams can see exactly what was proven at access time.
Bottom line: Device-based biometrics can improve access security without proving the person behind the login is who they claim to be.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:49 am
Biometric possession is not identity assurance: The article exposes a basic programme flaw in how many teams frame passwordless access. A device-bound factor can confirm continuity with an enrolled authenticator, but it does not by itself prove the subject behind the session. The governance implication is that IAM teams must stop treating possession as a proxy for verified identity.
A question worth separating out:
A: They should raise assurance when the action has material financial, operational, or regulatory impact, such as funds movement, privileged access, or sensitive data approval. The right threshold depends on business risk, not convenience. A stronger workflow for high value transactions helps prevent identity deception while allowing lighter checks for low risk tasks.
👉 Read our full editorial: Biometric authentication still needs verified identity, not just possession