Named a Leader: 2026 Gartner® Magic Quadrant™ for Identity Verification
The problem
Your help desk is a goldmine for social engineers
Scattered Spider is a loose network of hackers linked to attacks on MGM Resorts, Caesars Entertainment, and Marks & Spencer. In July 2026, the US Justice Department tied the group to 100+ network intrusions and over $100 million in ransom payments. Copycat groups now run the same four-step playbook, and it works against any help desk that still relies on security questions to verify callers.
LinkedIn profiles and breach data give the attacker an employee's ID number and the answers to your agents' security questions.
On a vishing call, the attacker poses as that employee, clears the security questions, and asks the agent for a password or MFA reset.
The agent enrolls the attacker's device on the account, so every MFA prompt from that point forward goes straight to the attacker.
Every login now looks legitimate to your identity provider while the attacker escalates access, steals data, and deploys ransomware.
The solution
Prove every identity, before anything is reset
1Kosmos caller verification has each caller scan a government ID and take a live selfie before any password or MFA reset. The identity decision moves out of your agents’ hands, and a caller using stolen details has nothing to pass.
Government ID verification
Callers scan a driver's license, passport, or national ID from any of 194+ countries, and 1Kosmos validates its security features.
Biometric identity matching
Liveness detection blocks recordings and deepfakes, then 1Kosmos matches the caller's selfie to their photo ID with 99%+ accuracy.
Appless caller verification
Callers complete verification in any browser on any camera-equipped phone or desktop, with no app download or pre-enrollment.
One-click caller authentication
Agents start verification with a single click and get a real-time pass or fail result, with no identity judgment or manual review.
Zero PII exposure
Agents never see the caller's personal data, and everything captured is deleted from session memory as soon as the check completes.
Issuing-authority checks
For your highest-risk accounts, an optional check validates the document against issuing-authority data through AAMVA and ICAO.
Stronger help desk security, live in 48 hours
Start standalone
1Kosmos is typically configured for live use within 48 hours, so agents can verify callers before any integration work begins.
Embed it when you're ready
Out-of-the-box connectors for ServiceNow, Jira, ManageEngine, and Freshdesk bring verification into the workflow your agents already use.
Extend it past the help desk
The same ID and selfie check handles one-time identity proofing for existing employees, new contractors, and job candidates.
Recognized & certified
FAQs
Scattered Spider is a loose network of young, English-speaking cybercriminals, also tracked by security researchers as Octo Tempest, UNC3944, and 0ktapus. The group drew global attention with its 2023 attacks on MGM Resorts and Caesars Entertainment and has since been linked to attacks on major retailers, including Marks & Spencer. In July 2026, the US Justice Department tied Scattered Spider to more than 100 network intrusions and over $100 million in ransom payments. Its signature move is calling IT help desks while posing as an employee.
1Kosmos takes the identity decision out of your agents' hands. When a caller requests a password or MFA reset, the agent starts verification with one click, and the caller scans a government ID and takes a live selfie in any browser, with no app or pre-enrollment. Liveness detection blocks recordings and deepfakes, and the selfie is matched to the ID photo with 99%+ accuracy. The agent sees a pass or fail in seconds and completes the reset only for a verified caller, so stolen employee details leave an attacker with nothing to pass.