Topic starter
24/06/2026 10:02 pm
TL;DR: Traditional IAM that verifies passwords or OTPs but not the person behind the login still leaves organisations exposed to account takeover, phishing-driven compromise, and downstream breaches, according to 1Kosmos. The core failure is architectural: identity assurance at enrollment and authentication is too weak to support modern access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What a Difference Identity Makes: Why IAM Keeps Falling Shortâand How to Fix It”.
Key questions
Q: What breaks when IAM verifies a password but not the person behind the login?
A: The trust model breaks at the point where access is granted to an account that may no longer belong to the enrolled identity.
Q: Why does weak identity proofing increase account takeover risk?
A: Because authentication only proves a user can present a secret or device, while proofing establishes who the user is.
A: Organisations should prefer strong second-factor methods that bind authentication to a physical credential rather than to reusable personal data.
Practitioner guidance
- Strengthen identity proofing at enrollment Require verified identity checks for new accounts before credentials or recovery methods are issued, especially where phishing or synthetic identity is a known risk.
- Separate authentication from identity assurance Document which access flows only authenticate a secret and which flows must also prove the person behind the account, then apply the stricter rule to high-risk access.
- Reassess recovery and account reset paths Treat password reset, MFA reset, and privileged recovery as identity-sensitive workflows that need stronger verification than everyday login.
Bottom line: The article argues that basic IAM controls can authenticate access without establishing confidence in the person behind the account.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:49 am
Identity proofing is the control boundary that traditional IAM has treated as optional. Passwords, OTPs, and even some biometric flows can authenticate a session without establishing durable confidence in the human behind it. That works only when enrollment and login assumptions remain benign, which modern phishing and replay attacks no longer allow. Practitioners should treat identity proofing as a governance boundary, not a convenience feature.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: When should security teams re-evaluate passwordless or biometric login in IAM?
A: They should re-evaluate it whenever the design assumes possession or liveness is enough to confirm identity. Passwordless and biometric methods can improve user experience, but they still need explicit identity proofing if the programme must resist phishing, impersonation, or account recovery abuse.
👉 Read our full editorial: IAM identity verification gaps keep account takeover easy