Topic starter
25/08/2026 6:10 pm
TL;DR: Knowledge-based authentication now fails because breach-exposed personal data and generative AI remove the secrecy and recall gaps it depended on, according to Trusona. The real issue is that account recovery still assumes knowledge questions can distinguish humans from automated fraud, when those assumptions have already collapsed.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “Moving Beyond Knowledge-Based Authentication: How to Protect Against Account Takeover in the Age of Generative AI”.
Key questions
Q: What should teams do first when knowledge-based authentication is still used for account recovery?
A: Remove KBA from the highest-risk recovery paths first, especially password resets, contact-detail changes, and any request that can move money or unlock sensitive access.
Q: Why do security questions fail against generative AI account takeover?
A: They fail because the answers are often no longer secret, and AI can produce them fast enough that human agents lose the behavioural cues they used to rely on.
Q: How can organisations tell whether password recovery is too weak?
A: Look for recovery flows that can restore access without strong identity proof, clear approval, or complete logging.
Practitioner guidance
- Retire static security questions from recovery flows Remove mother’s maiden name, first car, street name, and similar prompts from any workflow that can reset credentials or change account attributes.
- Reclassify help-desk recovery as a high-assurance control point Define account recovery, password reset, and profile change approval as privileged identity actions with stronger approval logic than ordinary support handling.
- Add authoritative-source verification to high-risk recovery steps Require government ID checks, document validation, or other authoritative evidence when recovery requests involve financial, administrative, or access-changing actions.
Bottom line: Knowledge-based authentication fails because it depends on secrets that are now exposed and on human recall that AI can outpace.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
KBA is a recovery control built on broken assumptions: It was designed for a world where personal data stayed obscure and human recall created friction for attackers. That assumption fails when breach data, OSINT, and AI assistance collapse the secrecy and speed gap. The implication is that account recovery can no longer be governed as a memory test.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What is the difference between KBA and risk-based identity proofing?
A: KBA asks the caller to recall information, while risk-based identity proofing evaluates multiple signals and can require stronger evidence when the transaction is sensitive. The first depends on secrecy and memory. The second depends on context, authoritative verification, and step-up controls. For recovery workflows, that difference determines whether the process is a convenience check or a real security boundary.
👉 Read our full editorial: Knowledge-based authentication fails under generative AI account takeover