Named a Leader: 2026 Gartner® Magic Quadrant™ for Identity Verification
The problem
Password resets are a weak link in your identity chain
Most password reset solutions were built around secrets and devices. Security questions confirm that someone can repeat a stored answer, and one-time codes confirm that someone is holding a registered phone number. Both of those can be bought, guessed, intercepted, or swapped, and neither tells you who is actually making the request.
An employee's ID number, start date, manager, and home address often sit in LinkedIn profiles and breach dumps. The answers your reset flow asks for are available to anyone who wants them.
A code sent by SMS or a push approval confirms possession of a phone number or a handset. SIM swaps, stolen devices, and prompt fatigue all defeat that check without anyone touching the account itself.
Frontline, deskless, and shared-workstation staff carry no enrolled device, and contractors were often never enrolled at all. Every one of those resets escalates to IT and leaves the employee offline while it waits.
The solution
Identity verification before every reset, powered by LiveID
With LiveID by 1Kosmos, an employee starts a reset from the login screen or your password reset portal, and takes a live selfie on any camera. LiveID matches that selfie against the government-issued ID the employee was proofed with at onboarding. On a pass, the reset completes and the employee signs in. On a fail, nothing changes and the attempt is logged with full evidence.
Identity-verified reset
Every reset is gated on a live biometric match. LiveID runs liveness and presentation attack detection before any factor changes, so a stolen answer fails.
Reuses the identity you already proofed
1Kosmos verifies identity at onboarding and binds it to a reusable credential. The reset reuses that proof, with no second enrollment and no extra vendor.
One flow covers password and MFA reset
One verified-identity check gates password reset, MFA reset, and device re-enrollment. An employee who lost a phone recovers everything in a single session.
Reaches the employees other tools miss
Verification runs in any browser on any camera, with no app and no enrolled phone. Frontline, deskless, and contractor users are covered like everyone else.
Privacy-preserving by design
Data is deleted at verification unless you turn on retention. Stored data sits inside an encrypted wallet the employee controls, never a central honeypot.
Proven at enterprise scale
The platform runs tens of millions of verifications and over two billion authentications a year. Concentrix runs 450,000 users on 1Kosmos with 98% success.
Deployment
Works with your stack from week one
1Kosmos sits in front of Microsoft Entra, Okta, Ping, ServiceNow, and Active Directory rather than replacing any of them. Your existing enterprise password reset workflows keep running, and the reset action still executes in your system of record. More than 150 pre-built connectors and configuration-driven setup put most workforce deployments live in weeks.
Recognized & certified
FAQs
Self-service password reset lets an employee reset their own password or unlock their own account without opening a ticket. Most SSPR and account recovery software checks the request using security questions or a one-time code sent to a registered device. 1Kosmos checks the employee, matching a live selfie against the government-issued ID they were proofed with, so the reset completes only for the person who owns the account. This way, you get an account recovery solution that verifies the person, rather than the credentials they can produce.
Those tools verify factors. They confirm that someone holds a registered device or can supply a stored answer, and a prepared attacker can satisfy both. 1Kosmos layers identity-verified reset on top of the self service password reset tools you already run. The Entra or Okta flow stays in place, the reset still executes there, and 1Kosmos decides whether the person requesting it is the employee named on the account.
Yes. One verified-identity check gates password reset, MFA factor reset, and enrollment of a replacement device, so an employee recovers everything in a single session. That removes the scenario that most often turns into a help desk password reset ticket, where someone recovers their password and remains locked out of their authenticator.
A live selfie takes seconds and runs in any browser with no app to install. Most employees finish faster than they would waiting on a ticket, because the entire reset happens in one session without a second person involved.
No, not by default. Verification data is deleted at the point of verification unless your organization turns on retention. When retention is on, the data lives inside a reusable identity wallet that stays encrypted and under the employee's direct control. The design removes the central honeypot that attackers normally target. Employees give consent before any enrollment or verification runs.