Topic starter
06/06/2026 11:33 am
TL;DR: Generative AI (53%) and agentic AI (45%) have overtaken stolen credentials as the top identity security concern, according to HYPR’s 2026 State of Passwordless Identity Assurance report, while passwordless adoption remains stalled at 43% and 87% of organisations have faced audio or video deepfake attacks. The security problem has shifted from login friction to industrialised impersonation, and identity assurance now has to cover the full lifecycle, not just the sign-in moment.
Editorial analysis by NHI Mgmt Group, based on content published by HYPR: “Identity Verification Emerges as a New Enterprise Standard to Combat Rising Impersonation Threats, Despite Plateau in Passwordless Adoption”.
Key questions
Q: How should organisations handle impersonation risk when passwordless adoption stalls?
A: They should treat passwordless as one control layer and add stronger identity verification around enrollment, recovery, and high-risk changes.
Q: Why are AI deepfakes a problem for identity verification?
A: AI deepfakes weaken verification because they make voice and video far less reliable as identity signals.
Q: What are the signs that an identity assurance programme is not working?
A: Common warning signs include multiple MFA tools with no clear consolidation path, manual employee verification, disconnected onboarding processes, and poor visibility into identity metrics.
Practitioner guidance
- Strengthen identity proofing at enrollment Require higher-assurance proofing for new accounts, recovery requests, and role changes so identity trust is established before access is granted.
- Harden recovery and help desk workflows Replace knowledge-based or human-recognition checks with verifiable evidence, especially where voice, video, or social engineering can be used to impersonate users.
- Extend verification into offboarding and re-verification Re-check identity trust when users change role, regain access, or return from inactivity so assurance does not decay after initial onboarding.
Bottom line: AI-driven impersonation is now competing with stolen credentials as a leading identity risk, which changes what IAM teams must defend.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:26 pm
Identity verification is becoming a governance control, not just an authentication control. Passwordless adoption reduces friction and shrinks some credential risk, but it does not answer whether the requester is genuine. As AI scales impersonation, identity assurance has to move into enrollment, recovery, and lifecycle governance. The practitioner implication is that IAM teams must measure assurance quality across the full identity journey, not only at sign-in.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: Should teams use passkeys, identity verification, or both?
A: They should use both, but for different jobs. Passkeys reduce phishing and password theft at authentication time, while identity verification raises confidence in the person behind the request. Organisations that want durable assurance need both secure sign-in and stronger lifecycle verification, not a single control used as a catch-all.
👉 Read our full editorial: Identity verification is overtaking passwordless as AI risk grows