Topic starter
24/06/2026 10:20 pm
TL;DR: Knowledge-based authentication can add a lightweight check to identity verification, but static questions are guessable, dynamic questions depend on external data quality, and both are vulnerable to breach exposure and social engineering, according to 1Kosmos. For IAM teams, KBA should be treated as a fallback signal, not a durable trust anchor, in modern authentication programmes.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Knowledge-Based Authentication (KBA) Explained”.
Key questions
Q: What breaks when knowledge-based authentication is the only fallback control?
A: KBA breaks when the answer space is public, reused, or easy to research.
Q: Why do static KBA questions create more risk than assurance?
A: Static questions create risk because the prompts never change and the answers often come from information that is already public or broadly shared.
Q: How can security teams judge whether dynamic KBA is actually useful?
A: Teams should ask whether the data sources behind the questions are private, current, and hard to reconstruct from open-source information.
Practitioner guidance
- Limit KBA to low-risk fallback paths Use KBA only where a secondary check is genuinely needed and the business impact of failure is limited.
- Replace static questions with stronger verification Move sensitive access flows toward device-based authentication, biometrics, or passwordless methods that do not depend on remembered personal facts.
- Audit KBA question sets for public-answer exposure Review whether the answer set can be reconstructed from social profiles, public records, or breached data.
Bottom line: Knowledge-based authentication is too exposed to serve as a primary identity control in modern IAM programmes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:58 am
KBA is a low-assurance identity fallback, not a trust anchor: Its value is procedural convenience, not durable authentication strength. When security teams rely on it as if it were a primary check, they confuse familiarity with assurance. The practical conclusion is that KBA belongs only at the edge of risk decisions, never at the centre of access control.
A question worth separating out:
Q: Should organisations keep biometrics in MFA or use them alone?
A: Organisations should keep biometrics in MFA because biometrics are a verification factor, not a complete trust model. When biometrics are paired with another independent factor, a spoofed sample is far less likely to produce full access, even if the biometric reader is fooled.
👉 Read our full editorial: Knowledge-based authentication is a weak identity fallback