Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Help desk verification still assumes a prior enrollment step in most IAM flows, but Trusona argues that the highest-risk callers are often the ones with no registered factor at all. That breaks common reset and recovery assumptions, because identity proofing must work against an external authority rather than the organization’s own records.
NHIMG editorial — based on content published by Trusona: How to verify users without pre-registration
By the numbers:
- The ratio of non-human to human identities now exceeds 100:1 in enterprise environments.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: What breaks when identity verification still depends on pre-registration?
A: Recovery fails for the users who need help most, because the system has nothing current to compare against.
Q: Why do organisations need a separate process for never-enrolled users?
A: Because the absence of an enrolled factor is not temporary noise, it is a recurring operational state.
Q: How can security teams verify a caller who has no factor on file?
A: They should use an external authority that already holds a record of the person, such as an issuing agency or carrier validation, rather than trying to inspect a user-managed secret that does not exist.
Practitioner guidance
- Define a never-enrolled recovery path Separate first-time verification from routine MFA recovery so the help desk does not improvise under pressure.
- Require live external authority checks Use an issuing authority or carrier validation when no trustworthy internal factor exists.
- Remove hidden enrollment dependencies Review every no-app or no-download claim for a concealed prerequisite such as a stored phone number, prior session, or registered factor.
What's in the full article
Trusona's full blog covers the operational detail this post intentionally leaves for the source:
- The live call flow for verifying a person with no pre-registered factor, including how the session begins and ends.
- The distinction between document inspection and authoritative record verification, including what the agent actually sees.
- Operational handling for cases where the user has no smartphone, no app, or no internal record at all.
- The retention and deletion model for session data after verification completes.
👉 Read Trusona's blog on verifying users without pre-registration →
Pre-registration identity verification: what changes for help desk teams?
Explore further
02/09/2026 1:30 pm
Pre-registration is a hidden assumption in most identity assurance designs. Verification programmes are usually built around an earlier enrollment step, whether that is a device, a passkey, or a stored biometric. That assumption holds for ordinary access but fails when the user has no prior factor, which is common in help desk recovery, contractor onboarding, and legacy user populations. The implication is that identity assurance must be designed around the full lifecycle, not just the happy path.
A few things that frame the scale:
- The ratio of non-human to human identities now exceeds 100:1 in enterprise environments, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity programmes still lose track of non-human actors.
A question worth separating out:
Q: What should help desk teams do when a caller pressures them for an immediate reset?
A: They should follow a scripted proofing path and refuse to downgrade assurance because the caller is urgent. If the caller cannot satisfy the live verification step, the request should pause and escalate. Speed is not a substitute for identity confidence, especially when the account is being recovered rather than newly authenticated.
👉 Read our full editorial: Verifying users without pre-registration changes help desk identity risk
