Yubico, a leading provider of hardware authentication security keys, has announced new strategic integrations with identity assurance firms HYPR and Nametag. The partnerships are designed to embed high-assurance identity verification directly into the provisioning and recovery lifecycle of its YubiKeys, addressing a critical security gap in remote employee onboarding.
This new initiative, part of Yubico’s “Bring Your Own IDV” (BYOIDV) strategy, directly confronts the rising threat of sophisticated identity fraud, including AI-driven deepfakes and social engineering attacks. Previously, while YubiKeys provided strong protection at the point of login, the initial process of issuing a key to a remote user often relied on weaker, trust-based methods. Attackers could exploit this by impersonating a new employee to get a legitimate, company-issued security key.
The new workflow closes this loop. Under the “YubiKey as a Service” offering, an organization can now require a user to prove their real-world identity before their hardware key is activated. In partnership with HYPR, which provides its “HYPR Affirm” solution, and Nametag, which offers its “Deepfake Defense” engine, users will be guided through a verification process. This typically involves scanning a government-issued photo ID, such as a driver’s license or passport, and completing a biometric liveness check via their device’s camera.
Once the identity verification is complete, the YubiKey— which may have been pre-registered to that specific user and shipped to their home— is officially activated and bound to the enterprise’s identity provider. Yubico provisions a pre-registered FIDO credential to the YubiKey, binds it to the organization’s identity provider, and ships the key directly to the end user with no IT or security team intermediation required.
Albert Biketi, Chief Product and Technology Officer at Yubico, stated that this integration extends trust “across the entire user lifecycle, from identity creation to login.” The goal is to create a verifiable trust chain from day one, ensuring the person receiving the key is unequivocally the right person.
Bojan Simic, CEO of HYPR, added that the partnership “guarantee[s] that the industry’s strongest security key is bound to a verified user and a trusted device.” This marriage of modern identity proofing with hardware-backed FIDO2 authentication aims to make passwordless deployments safer and reduce friction for IT departments, who no longer need to manage the risky distribution of initial credentials or shared secrets.
Aaron Painter, CEO of Nametag, noted that “Nametag is uniquely capable of proving that the person receiving and setting up a YubiKey is not just a real person, but the right person.”
Sources: Business Wire, HYPR Blog
—
By Ali Nassar-Smith
