Notifications
Clear all
Topic starter
24/06/2026 9:02 pm
TL;DR: Passwordless identity verification, biometrics tied to verified credentials, and strong government certifications are positioned as the response to password and SMS-based MFA failures, according to 1Kosmos. The shift matters because identity assurance now has to replace perimeter-era trust assumptions across human access programmes, not just add another login layer.
NHIMG editorial — based on content published by 1Kosmos: passwordless identity verification, biometric assurance, and the shift away from password-centric security
By the numbers:
- The company says its recent $57 million Series B brings total funding to over $72 million.
- The article cites a $194.5 million agreement for Login.gov through Carahsoft.
Questions worth separating out
Q: How should organisations decide where passwordless authentication is worth using?
A: Use passwordless first where phishing risk, remote access, or high-value data make credential theft more dangerous than enrolment friction.
Q: Why do deepfakes and social engineering change human IAM requirements?
A: They change the threat model from secret theft to identity impersonation.
Q: What do organisations get wrong when they replace passwords with biometrics?
A: They often assume the biometric itself is the security control.
Practitioner guidance
- Reassess login assurance by population Separate low-risk employee logins from privileged, contractor, and citizen-style access flows, then define different assurance levels for each.
- Harden identity proofing and recovery Review enrolment, recovery, and account re-binding steps for passwordless access so the process is stronger than the password flow it replaces.
- Map authentication standards to policy Use NIST 800-63-3 and FIDO2 as the basis for access policy decisions, then codify which applications require phishing-resistant methods and which can tolerate lower assurance.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- How the biometric-to-credential binding model works in practice for passwordless authentication
- What the vendor means by deployment times measured in hours instead of months
- How the platform positions NIST 800-63-3, FIDO2, and FedRAMP High in its assurance story
- Which customer and government use cases the vendor says are driving adoption
👉 Read 1Kosmos's analysis of passwordless identity verification and human IAM →
Passwordless identity verification: what it means for IAM teams?
Explore further
25/06/2026 6:00 am
Passwordless is a human identity assurance problem, not just an authentication preference. The article treats the removal of passwords as the core answer to account takeover, but the deeper issue is whether identity proofing, recovery, and session re-authentication are strong enough to sustain trust at scale. In human IAM, the weakest link often moves from the login factor to the lifecycle around it. Practitioners should judge passwordless by its end-to-end assurance model, not by user convenience alone.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly identity assurance problems expand once machine access is in scope.
A question worth separating out:
Q: Who is accountable when passwordless authentication fails or is abused?
A: Accountability sits with the identity, security, and application owners who define assurance policy, recovery design, and access enforcement. If those decisions are inconsistent across systems, the control breaks at the governance layer rather than the authentication layer. Standards such as NIST 800-63-3 help, but local ownership still determines outcomes.
👉 Read our full editorial: Passwordless identity verification is replacing perimeter assumptions
