Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: Deepfake identity attacks can now be built from public photos and widely available voice- or face-cloning tools in minutes, while layered verification and risk policy are needed to decide what happens next, according to HYPR. The security problem is no longer spotting synthetic media, but operationalizing identity assurance so risk signals change outcomes.
NHIMG editorial — based on content published by HYPR: Beyond Deepfake Detection: Operationalizing Identity Assurance
By the numbers:
- HYPR Affirm evaluates approximately 55 risk signals across biometric analysis, document intelligence, location intelligence, identity intelligence, and OTP verification to build a more complete picture of identity risk throughout the verification process.
Questions worth separating out
Q: How should security teams handle deepfake risk in identity workflows?
A: Security teams should treat deepfakes as a trust and verification problem inside identity workflows.
Q: Why do single deepfake checks fail in modern identity assurance programmes?
A: Single checks fail because synthetic identities often look convincing enough to pass one control while still showing weaknesses elsewhere.
Q: What do security teams get wrong about deepfake-resistant identity checks?
A: They often focus on face-match accuracy and ignore the capture environment.
Practitioner guidance
- Define policy outcomes for high-risk identity events Map combinations of biometric, document, device, and location signals to explicit actions such as step-up verification, escalation, redirection, or denial.
- Separate detection from decisioning Treat deepfake detection as one input to an identity assurance policy, not as the end of the process.
- Cap repeated verification attempts Set retry budgets for suspect sessions so attackers cannot keep testing variations until one passes.
What's in the full article
HYPR's full blog post covers the operational detail this post intentionally leaves for the source:
- The live deepfake demonstration and how the synthetic identity was assembled from publicly available materials
- The full breakdown of the approximately 55 risk signals used in HYPR Affirm across the verification flow
- The specific behaviour of the Risk Policy Builder, including how outcomes are routed and logged
- The retry and audit settings discussed for repeated verification attempts
👉 Read HYPR's analysis of how identity assurance must move beyond deepfake detection →
Deepfake detection and identity assurance: what teams need now?
Explore further
24/07/2026 4:13 pm
Deepfake defence fails when identity assurance is treated as a single decision point. The article shows why visual inspection or one-off deepfake detection cannot carry a modern human IAM programme. Synthetic identity attacks succeed by blending plausible media with ordinary verification steps, so the control problem is not detection alone but the point at which trust is granted. Practitioners should treat identity assurance as a sequence of evidence-based decisions, not a binary check.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How can organisations make identity proofing more resilient to synthetic media?
A: Organisations should make identity proofing risk-based, layered, and auditable. Use multiple signals, define response thresholds for each protected action, limit repeated attempts, and keep a trace of why each decision was made so the process can be reviewed and improved over time.
👉 Read our full editorial: Identity assurance must move beyond deepfake detection
