Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
Yubico Partners with HYPR and Nametag to Fortify YubiKey Provisioning with Identity Verification
Yubico has partnered with HYPR and Nametag to integrate biometric and document-based identity verification into the provisioning and recovery lifecycle of its YubiKeys. The new workflow ensures that only verified users can activate their keys, addressing a longstanding security gap in remote employee onboarding. Users are guided through ID and liveness checks powered by HYPR’s Affirm platform and Nametag’s Deepfake Defense engine before key activation. The integration establishes a verifiable trust chain from issuance to login, reducing risk from social engineering and impersonation attacks while simplifying passwordless deployments for enterprises.
GSMA Device Check Integrates with SLC eSIM Platform to Create Hardware-Rooted Identity
SLC Digital has added the GSMA’s Device Check service to its eSIM-based identity platform, enabling real-time validation of a device’s authenticity and security status. The integration allows organizations to verify both the user and the device during authentication by querying the GSMA’s global registry of lost or fraudulent hardware. The result is a cryptographically signed “device identity” that confirms integrity and authorization, adding telecom-grade assurance to fintech, IoT, and banking applications. The platform supports FIDO, NIST, and GDPR standards, establishing a hardware-rooted identity model to combat cloned and compromised devices.
DocuSign Achieves NIST IAL2 Compliance by Integrating ID.me and Clear Biometric Verification
DocuSign has integrated ID.me and Clear biometric identity verification into its platform to meet the U.S. federal Identity Assurance Level 2 (IAL2) standard. The new workflow embeds government-recognized identity proofing directly into digital signing processes for sensitive transactions such as SBA loan applications, digital vehicle title transfers, and HIPAA-compliant consent forms. Users can verify their identities using existing ID.me or Clear accounts through document uploads and liveness checks, creating a tamper-evident audit trail for regulatory compliance. The feature strengthens DocuSign’s Intelligent Agreement Management platform by aligning it with NIST 800-63-3 standards for high-assurance digital identity.
Browser Security Report Finds Identity Risks Have Migrated to the Web Client
LayerX Security’s 2025 Browser Security Report reveals that the browser has become the weakest link in enterprise identity protection, with 68 percent of SaaS logins occurring outside managed SSO environments. The report highlights how attackers exploit session hijacking and browser extensions to steal credentials and exfiltrate data. Generative AI has exacerbated the risk, with 77 percent of employees pasting corporate data into AI tools, often using unmanaged personal accounts. The report urges organizations to extend identity and data visibility “beyond the IdP” to the browser itself, positioning it as the new control plane for enterprise workflows.
RSA Report: 69% of Firms Hit by Identity Breaches as Passwordless Adoption Stalls
RSA’s 2026 ID IQ Report finds that 69 percent of organizations have suffered identity-related breaches in the past three years, while passwordless adoption remains sluggish. Social engineering of IT service desks has emerged as the leading identity risk, with 65 percent of security leaders citing it as their top concern. Despite these challenges, most organizations continue to rely on passwords, hindered by hybrid IT environments and poor user experience. The report notes that 91 percent of respondents plan to adopt AI-based defenses in the coming year, reflecting growing optimism about AI’s role in mitigating identity threats.
High-Severity Devolutions PAM Flaw Allows Account Hijacking Before MFA
Researchers have uncovered a critical vulnerability in Devolutions Server (CVE-2025-12485) that allows attackers to impersonate other users before multi-factor authentication is completed. The flaw, rated 8.8 on the CVSS scale, enables a low-privilege user to replay a pre-MFA session cookie to gain elevated access if the victim approves an MFA request. A secondary issue (CVE-2025-12808) also exposed hidden password fields to read-only users, violating role-based access controls. Devolutions has patched both flaws in versions 2025.3.6.0 and 2025.2.17.0, urging immediate updates to mitigate account hijacking risks in privileged access environments.
Sri Lanka Shortlists Five Indian Firms for National Digital ID Contract
Sri Lanka has shortlisted five Indian technology firms—Infosys, TCS, Protean eGov Technologies, RailTel, and Bharat Electronics Ltd—for its national digital ID system, the SL-UDI. The program, built on India’s MOSIP open-source platform, aims to create a unified biometric identity for all citizens and residents. Funded in part by a $67 million grant from India, the project will integrate existing ID systems and serve as the foundation for digital public services. A local managed service provider will assume long-term operation after an initial six-month transfer period, with the launch targeted for March 2026.
Home Office Updates ETA Guidance: Identity, Biometrics, and Fraud Controls
The UK Home Office has issued Version 8.0 of its Electronic Travel Authorisation (ETA) caseworker guidance, expanding eligibility to additional European nationals and clarifying rules on biometric collection, identity verification, and fraud screening. Applicants must provide a valid passport and facial biometric, with manual review required for failed automated matches or adverse records. The update also reinforces mandatory refusal criteria for criminality and misuse of lost or stolen documents. The £16 ETA, valid for two years, is being rolled out to all visa-exempt travelers as the UK continues scaling its biometric entry infrastructure.
UK Trials “Passport-Free” Facial Recognition Border Checks at Manchester Airport
The UK Border Force has completed a three-week pilot at Manchester Airport enabling British passport holders to pass through arrivals using facial recognition without scanning their passports. The trial, part of the Home Office’s “intelligent border” initiative, showed significant reductions in processing time. The system matches live facial images against government records, echoing similar deployments in Australia and Dubai. If expanded nationally, the technology could transform the UK’s 270 ePassport gates into fully contactless checkpoints, though officials stress the need for oversight, watchlist integration, and fallback protocols before broad rollout.
–
By the ID Tech Editorial Team