VeriClouds provides identity threat intelligence that stops attackers from logging in with stolen credentials. Organisations use it to check employee and customer usernames and passwords against compromised credentials gathered from the dark web and hacker forums, blocking account takeover and credential stuffing before they succeed.
It is aimed at security, fraud and identity teams that already run authentication and MFA and want a check that a password has not leaked before it is accepted.
At A Glance
| Vendor | VeriClouds |
|---|---|
| Category | Identity threat intelligence, compromised credential detection |
| Identities covered | Employee and customer user credentials |
| Deployment | Cloud API service, or on-premises hardware appliance |
| Ownership | Acquisition by Enzoic agreed in 2024 |
| Market classification | Identity Verification |
What VeriClouds Does
Account takeover and credential stuffing depend on compromised, stolen or weak credentials. VeriClouds takes that ingredient away by checking each credential as it is used, so a password that has already leaked cannot open an account. CredVerify plugs into IAM systems and sits alongside existing authentication and MFA rather than replacing them. When a match turns up, the login can be interrupted and the user sent through identity verification and a password reset. The same intelligence is applied before and after login: when a password is first set, while credentials stay in use, and after a breach becomes public.
Products
CredVerify
CredVerify is a patented API service that blocks the use of stolen usernames and passwords in real time. It catches compromised employee or customer credentials during authentication and password reset, and automates response and remediation after known data breaches. Checks use the k-anonymity protection model, and a transmitter for the OpenID Shared Signals Framework pushes notifications to customers when credentials are compromised.
Account Takeover Protection
Security and fraud teams use this offering to keep watch on credentials after they are set. It monitors and verifies credentials continuously, flags compromised or reused passwords, and draws on the company’s Intelligence Data Lake for bot and fraud detection. Step-up authentication and password resets can be triggered automatically from indicators of compromise.
Enterprise Security
For enterprises, CredVerify protects workforce accounts, at a reported scale of 1 billion passwords a day at a large cloud provider. The same intelligence rates a supplier’s likelihood of breach from its presence on the dark web and hacker forums.
NIST Password Compliance
Identity providers can enforce NIST password guidelines by screening new passwords against lists of common or compromised passwords, including breach corpuses, dictionary words and context-specific words.
Shared Signals Framework Consulting
VeriClouds gives expert guidance to organisations adopting and implementing the OpenID Shared Signals Framework (SSF), the standard for sharing security events such as compromised credentials between identity systems.
How It Works
CredVerify runs as an API service in the VeriClouds cloud and connects through RESTful APIs, pre-built connectors and solution accelerators. It can also run in a customer’s own cloud environment, or as a hardware appliance on the customer’s network with no outside connectivity, storing billions of encrypted compromised credentials protected by Intel SGX or SafeNet HSM hardware. The ITDR offering is modular, with data collection scripts, analytics, masking and encryption, and continuous monitoring feeding the same RESTful API layer that customers call from their identity platforms.
Identities And Systems Covered
| Workforce users | Employee credentials checked at login and password reset. |
|---|---|
| Customers | Customer credentials, with integrations for popular CIAM platforms. |
| Privileged users | Executives and privileged users assessed as a risk group in ITDR. |
| Identity platforms | Okta, Ping Identity DaVinci, ForgeRock Identity, One Identity Manager and SailPoint IdentityIQ. |
| Third parties | Supplier breach likelihood based on dark web presence. |
Company Background
| Headquarters | Seattle, United States. |
|---|---|
| Leadership | Stan Bounev, CEO at the time of the Enzoic agreement. |
| Acquisition | The agreement for Enzoic to acquire VeriClouds was announced on 14 October 2024, with customer contracts unchanged until the next renewal. |
| Recognition | A KuppingerCole Executive View of CredVerify. |
Note: This overview is compiled from VeriClouds’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.