Named a Leader: 2026 Gartner® Magic Quadrant™ for Identity Verification
The problem
Your workforce is verified once and trusted indefinitely
Most organizations prove identity thoroughly on day one and never prove it again. Every access decision afterward runs on a password, a device, or a security question, all of which can transfer between users without leaving a trace.
Verizon's 2026 Data Breach Investigations Report found credential abuse somewhere in 39% of breaches, more than any other vector. Attackers changed how they get in, and a password still proves only that someone passed a check.
Role changes expand access without anyone re-proving the person behind it. A promotion moves an employee into privileged systems on a credential issued months earlier. Workday and Fieldglass can trigger a step-up, few teams do.
The 2026 DBIR now tracks pretexting as an initial access vector, at 6% of breaches. Help desk impersonation runs on employee ID numbers, manager names, and birth dates, the exact details sitting in any breach dump for sale.
Third-party involvement in breaches is climbing too. Contractors, BPO agents, vendors, and seasonal staff onboard faster than employees, often through a staffing partner, and reach production systems within days of signing on.
The solution
Employee identity verification at every access moment
1Kosmos proves identity to IAL2 with a government-issued document, liveness detection, and a LiveID facial biometric. That proof becomes the credential, and it holds at every access moment for the length of employment.
Day-one credential, no temporary password
The verified identity provisions Entra or Okta and enrolls the authenticator, with a TAP code for setup.
Help desk and account recovery
LiveID replaces knowledge questions, and SSPR completes in under two minutes via a ServiceNow connector.
Authenticator enrollment
Only the verified employee can register or replace an authentication factor in Microsoft or Okta Verify.
Privileged access and step-up
Workday and Fieldglass role changes gate access until LiveID proofing completes, with no re-enrollment.
Shared and frontline workstations
1Key matches a fingerprint to the verified identity in under two seconds at a shared workstation or POS.
Continuous authentication
Typing cadence confirms the enrolled user is still at the keyboard, and a substituted user is locked out.
From onboarding to login
One verification covers it all
Most verification ends at onboarding. From that day forward, every login runs on a credential, and a credential can be handed to anyone.
1Kosmos runs identity verification and passwordless authentication on one platform, then feeds the verified identity into Okta, Microsoft Entra, and ServiceNow through 150+ prebuilt connectors that go live in two to ten weeks.
Nothing gets ripped out, and the same LiveID scan that verifies a new employee on day one signs them in on day 300.
For frontline workforces
Passwordless where Windows Hello stops
Windows Hello and Secure Enclave assume one person per device. But frontline associates, call center agents, and clinicians share workstations on rotating shifts.
1Key by 1Kosmos attaches a biometric reader to any workstation and opens a session under the employee's own credentials and permissions, with no password or PIN to hand around. Where cameras and phones are banned, behavioral typing authenticates without an exposed biometric.
Workforce identity verification by industry
Industry
Where verification runs
Retail
Seasonal onboarding at volume, SSPR, and 1Key at POS terminals and warehouse scanners
Healthcare
Clinician and contractor verification, with fast user switching between patient rooms
Manufacturing, aerospace & defense
Shared and OT workstation access with 1Key, integrated to CyberArk and BeyondTrust
Financial services & insurance
Agent, advisor, and outsourced contractor access to customer funds and regulated data
Telecommunications
Retail and call center staff at the points most often targeted by social engineering
Higher education
Identity proofing across employee, contractor, and student populations
Recognized & certified
FAQs
An employee scans a government-issued ID and takes a live selfie via LiveID. 1Kosmos validates the document, confirms a physically present person through liveness detection, and matches the two. That proof is then reused for login, account recovery, authenticator changes, and privileged access, so every access decision traces back to a verified person.
Automated document verification reads the security features and data encoding of an ID against known specifications for that document type. 1Kosmos validates 4,000+ formats across 144 countries, and where records exist, against the issuing authority. Liveness detection and biometric matching then confirm the person presenting it is its owner.
Four things. Assurance that meets IAL2 under NIST 800-63. Deterministic results an access workflow can act on without human interpretation. Coverage that extends past onboarding to every access moment. And verification that connects to authentication, so the person proven is the person who signs in. 1Kosmos delivers all four on one platform.
MFA confirms possession of a factor: a password, a device, a one-time code. A passkey binds to an account and can be shared through a password manager. Employee identity verification binds to the person, and you cannot give your face away. Biometric MFA on a verified identity grants access because the verified employee is present.
Verification runs from any smartphone or browser in under a minute, across 144 countries and 4,000+ document formats. An offshore contractor, a BPO agent, and a headquarters employee complete the same flow against the same evidence standard, so third-party access carries the same proof as your own payroll.
Yes. Workforce re-verification runs on a schedule, at defined risk events, or across an entire population at once, typically after acquisitions, ahead of audits, or before granting privileged access. It also surfaces accounts that trace back to no verified person, which is how ghost employee records survive offboarding.
No. The entire flow runs from a browser or a QR scan on the employee's own phone, with nothing to install. That matters most for contractors and frontline staff, where an app download is the step that stalls a rollout. Returning employees reverify in seconds with a face scan.