Topic starter
24/06/2026 10:20 pm
TL;DR: Knowledge-based authentication is too exposed to serve as a primary identity control in modern IAM programmes, according to 1Kosmos. KBA should stay as a narrow fallback because discoverable answers weaken recovery and access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Knowledge-Based Authentication (KBA) Explained”.
Key questions
Q: Why do static KBA questions create more risk than assurance?
A: Static questions create risk because the prompts never change and the answers often come from information that is already public or broadly shared.
Q: How can security teams judge whether dynamic KBA is actually useful?
A: Teams should ask whether the data sources behind the questions are private, current, and hard to reconstruct from open-source information.
Q: What breaks when knowledge-based authentication is the only fallback control?
A: KBA breaks when the answer space is public, reused, or easy to research.
Practitioner guidance
- Limit KBA to low-risk fallback paths Use KBA only where a secondary check is genuinely needed and the business impact of failure is limited.
- Replace static questions with stronger verification Move sensitive access flows toward device-based authentication, biometrics, or passwordless methods that do not depend on remembered personal facts.
- Audit KBA question sets for public-answer exposure Review whether the answer set can be reconstructed from social profiles, public records, or breached data.
Bottom line: Knowledge-based authentication is too exposed to serve as a primary identity control in modern IAM programmes.
Glossary terms: Knowledge-based authentication, Static KBA, Dynamic KBA, Fallback authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:58 am
KBA is a low-assurance identity fallback, not a trust anchor: Its value is procedural convenience, not durable authentication strength. When security teams rely on it as if it were a primary check, they confuse familiarity with assurance. The practical conclusion is that KBA belongs only at the edge of risk decisions, never at the centre of access control.
A question worth separating out:
Q: Should organisations keep biometrics in MFA or use them alone?
A: Organisations should keep biometrics in MFA because biometrics are a verification factor, not a complete trust model. When biometrics are paired with another independent factor, a spoofed sample is far less likely to produce full access, even if the biometric reader is fooled.
👉 Read our full editorial: Knowledge-based authentication is a weak identity fallback