Notifications
Clear all
Topic starter
24/06/2026 10:50 pm
TL;DR: Identity fraud is increasingly driven by forged documents, deepfake-enabled impersonation, and context-aware social engineering, according to HYPR’s analysis citing Gartner. The core problem is that verification models built on one-time signals and static credentials assume trust can be proven once, then reused; that assumption no longer holds.
NHIMG editorial — based on content published by HYPR: Context-Based Attestation for Identity Verification
By the numbers:
- By 2028, one in four candidate profiles will be fake.
Questions worth separating out
Q: How should identity teams handle deepfake-enabled impersonation in onboarding and recovery flows?
A: Identity teams should assume a single proofing event can be replayed or faked.
Q: When does one-time identity verification create more risk than it removes?
A: It creates more risk when the workflow includes onboarding, account recovery, helpdesk resets, or high-trust approvals.
Q: What do security teams get wrong about human-in-the-loop identity checks?
A: They often treat human approval as a final answer instead of one signal among many.
Practitioner guidance
- Correlate assurance across workflow stages Link hiring, onboarding, account recovery, and access changes into one evidence chain so a strong signal at one step is not treated as complete trust.
- Add peer validation only with audit evidence Use managers or trusted colleagues for high-risk attestations, but require the request context, relationship context, and decision outcome to be recorded together.
- Review helpdesk recovery paths for impersonation exposure Treat password reset, identity recovery, and service desk escalation as attack surfaces.
What's in the full article
HYPR's full blog post covers the operational detail this post intentionally leaves for the source:
- The specific orchestration flow for combining peer validation, workflow context, and behavioural continuity.
- The product-side explanation of how context-based attestation is surfaced inside the Identity Risk Suite.
- The examples of when adaptive challenges are triggered during hiring, account recovery, and access changes.
- The vendor's discussion of why continuous identity assurance is framed as a state, not a one-time event.
👉 Read HYPR's analysis of context-based attestation for identity verification →
Context-based attestation: what it changes for identity assurance?
Explore further
25/06/2026 7:40 am
Context-aware trust is now a governance requirement, not a user-experience refinement. Identity teams have spent years optimising point-in-time verification, but the article shows why that model fails when attackers can reproduce the signal being checked. The practical issue is not whether a document or voice sample looks real at one moment, but whether the interaction still makes sense across the full workflow. That shift changes how IAM, fraud, and helpdesk governance should be evaluated.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A further 47% have only partial visibility, which means most programmes cannot reliably trace delegated trust paths end to end.
A question worth separating out:
Q: Who is accountable when impersonation succeeds in a service desk or onboarding workflow?
A: Accountability usually sits across identity governance, helpdesk operations, and the business owner of the workflow. If the process allowed a single uncorroborated interaction to trigger trust, the control failure is shared. NIST-style governance and access review processes should define ownership before the incident occurs.
👉 Read our full editorial: Context-based attestation raises the bar for identity verification
