Most organizations shopping for identity verification (IDV) today start in the wrong place. They look at vendors built for banking and fintech KYC compliance, evaluate the feature set, and assume the technology transfers cleanly to employee onboarding and IT helpdesk workflows. It usually doesn't.
Recent Gartner® research on workforce IDV says: "The majority of IDV vendors in the market today do not focus on workforce use cases. Using a vendor that typically only focuses on customer use cases will lead to increased implementation costs and the inability to service some workforce scenarios effectively."
That gap between consumer-oriented IDV and workforce IDV is something worth discussing.
What drove the shift to workforce IDV
IDV originated as a compliance tool. In banking and online gambling, know-your-customer (KYC) regulations required organizations to confirm a user's identity before opening an account. The model is straightforward: a stranger shows up, you verify who they are.
Workforce scenarios are structurally different. Sometimes you're verifying someone you've never met, like a job candidate. Other times you're re-verifying someone already in your systems, like an employee who locked themselves out of an account. The risk models and the required integrations are completely different depending on which scenario you're in.
Two specific threat patterns pushed workforce IDV onto the CISO agenda.
The first was a series of social engineering attacks against IT helpdesks. Groups including Scattered Spider, ShinyHunters, and LAPSUS$ compromised organizations including MGM, Harrods, and Marks & Spencer by calling IT service desks and impersonating employees during account recovery requests. Once access was granted through a phone call, attackers moved laterally, deployed ransomware, or exfiltrated data.
The second was the North Korean IT worker problem. Multiple organizations, including KnowBe4 and Amazon, discovered they had interviewed or hired individuals using stolen or counterfeit identity documents combined with deepfakes on video calls. The FBI issued a formal warning to U.S. businesses about this specific threat vector.
Both attack patterns share the same root cause: no real-time, document-backed identity verification at the point of interaction.
The foundational layer: detecting attacks on the IDV process itself
Before evaluating workforce-specific features, any IDV vendor needs to pass a baseline check on the integrity of the verification process itself.
CISOs should use vendors that have the following baseline features to detect attacks on the IDV process:
Presentation Attack Detection (PAD): An attacker may present a fraudulent artifact such as an attacker wearing a mask, a deepfake image of a document, or a face displayed on a monitor screen to the camera. PAD is designed to detect such attacks. Favor vendors that have been assessed in conformance with the ISO 30107-3 standard for PAD, ideally to Level 3.
Injection Attack Detection (IAD): An attacker may bypass the camera and inject a fraudulent digital artifact into the application flow, for example, by using a virtual camera, smartphone emulator, or an attacker-in-the-middle process. IAD is designed to detect such attacks. Favor vendors that have been assessed in accordance with the CEN 18099 standard for IAD. This is a new standard, so relatively few vendors have been tested against it.
Contextual Signals: Additional signals such as location intelligence and device profiling can further help to protect the IDV process by detecting anomalies such as mismatches, velocity of use, and links between different IDV events.
What makes workforce IDV genuinely different
After confirming baseline integrity, workforce IDV selection diverges significantly from the consumer use case. The four areas where gaps most commonly surface are integrations, identity matching, PII handling, and authentication continuity.
Integration with enterprise applications
Consumer IDV is largely self-contained. A user downloads an app, scans a document, takes a selfie, and the vendor returns a pass/fail result. Workforce IDV needs to plug into the systems where action actually gets taken.
The Gartner research says, "Workforce use of IDV depends on tight integration with a number of different applications within the enterprise architecture depending on use case.” Cited examples include:
Access management (AM) platform
IT service management (ITSM) software
Human resources (HR) systems of record
Privileged access management (PAM) tools
Applicant tracking systems (ATS)
Background check services
The account recovery workflow illustrates why these integrations matter operationally. A service desk agent receives a call from someone claiming to be an employee. Ideally, the agent triggers IDV from within the ITSM platform without switching applications.
The IDV vendor verifies the document and selfie, then automatically checks the verified identity attributes against the AM or HR system of record. Only after a match is confirmed does the agent proceed. Without native ITSM integration, every step in that chain becomes a manual handoff, which introduces both latency and the risk of human error.
Some AM platforms now offer IDV natively as a feature. Where that's available, it can simplify the integration footprint.
Automated identity matching
Verifying that someone is who they claim to be is only half the problem. In account recovery, the verified identity also needs to match an existing employee record. This sounds simple and isn't.
Organizations store employee identity data inconsistently across HR systems and access management platforms. Name formats vary. Some records include middle names; others don't. Legal names differ from preferred names. Dates of birth may or may not be stored. Headshots may be available in some systems but not others.
Gartner outlines, “Select an IDV vendor who can do that matching in an automated fashion using a variety of approaches to align with the organization's data structures.” The report includes examples such as:
Name matching alone, using fuzzy logic and LLMs to account for genuine differences between the name as recorded on the identity document and the name in the employee record.
Name matching plus other attributes, such as date of birth.
Biometric comparison of the selfie from the IDV step with employee headshot on file.
Without automated matching, an IT service desk agent receives verified identity attributes and then has to manually search HR or AM systems for a corresponding record. That process exposes PII to the agent, requires broader system access grants, and adds significant handling time per ticket.
PII and biometric data handling
Workforce IDV introduces employee PII and biometric data into a third-party vendor's environment. For many organizations, especially those operating across multiple jurisdictions, this creates compliance complexity that doesn't exist in consumer IDV.
The requirements vary by organization and geography. Per the Gartner report, "IDV vendors for workforce should typically be offering capabilities,” such as the following:
Managing all user consent notices and consent gathering during the IDV process, modifiable per organizational requirements.
Having the ability to purge all PII and biometric data immediately after an IDV check is complete.
Having the ability to store PII and biometric data, with configurable retention and deletion policies.
Offering the capability for PII and biometric data to be stored in different geographies (e.g., within U.S. only or within EU only) to meet organizational requirements.
Offering the capability to store PII and biometric data within an environment managed by the organization.
Consent management during the IDV flow also needs to be configurable per organizational requirements.
Gartner recommends: “Organizational requirements for handling PII and biometric data can be met in different ways by IDV vendors. Ensuring early in the procurement process that these requirements are met is a crucial buying criterion.”
Authentication continuity and the path to passwordless
Full IDV (document scan plus selfie liveness check) is not a workflow employees will tolerate repeatedly. An employee who resets their password frequently, or who regularly uses PAM tools, needs a lighter-weight option for repeated verifications.
Some workforce-focused IDV vendors address this by treating the initial IDV check as an enrollment event. With consent, the employee's biometric data is stored securely. Subsequent verification requests can be satisfied with a selfie alone, without repeating the document scan step.
An alternative that avoids long-term biometric storage is the issuance of a verifiable credential (VC) after the initial IDV check. The credential lives on the employee's device within the vendor's app. The employee authenticates biometrically within the app and presents the VC to relying-party applications such as self-service password reset tools or PAM systems.
Gartner also mentions: “It should be noted that organizational discomfort about use of tools that leverage biometrics which are managed by a third-party is often already a headwind to using IDV, even when that biometric data can be purged after the IDV event. Storing biometric data long-term to facilitate authentication may not be palatable for some organizations.”
Evaluating vendors: the practical checklist
Organizations that skip workforce-specialized vendors and procure a consumer-oriented IDV product will typically encounter one or more of these outcomes:
Integration build-out that consumes engineering resources and delays deployment
Manual workarounds in service desk workflows that slow resolution times and expose PII
Incomplete coverage of the account recovery and onboarding use cases IDV was meant to secure
The selection decision
For CISOs evaluating IDV for workforce use cases, the vendor's integration roadmap and existing connectors to enterprise systems are as important as the core verification technology.
A vendor with excellent PAD and IAD scores but no ITSM or HR integrations shifts the build cost to the buyer's internal team.
—
Gartner, Workforce Identity Verification Requires Unique Capabilities, Akif Khan, Nayara Sangiorgio, James Hoover, 25 February 2026
GARTNER is a trademark of Gartner, Inc. and/or its affiliates
About the author
Huzefa Olia
Co-Founder & Chief Operating Officer
Huzefa is the COO and a co-founder of 1Kosmos with 18+ years in identity and access management and cybersecurity, focused on scaling operations, go-to-market strategy, and enterprise partnerships across global markets.
