For years, digital identity has operated on a fragile assumption: if you passed authentication once, you’re probably still you.

In an era where AI can convincingly clone faces, voices, and behaviors, identity has become trivially reproducible.

Today, personal information has become a continuous risk surface. Deepfakes, impersonation, and account takeover have evolved beyond edge cases, transforming into a beastly default attack model, powered by AI-generated digital identities.

That’s why the completion of Ping Identity’s acquisition of Keyless is more than just another identity-tech consolidation. It marks a philosophical shift in how enterprises should think about trust in the age of AI.

Trust Can’t Be Stored Anymore

Traditional biometrics promised convenience but came with a dangerous trade-off: centralized storage of sensitive biometric data. Once compromised, that data is irrevocable. You can reset a password. You can’t reset your face.

Zero-Knowledge Biometrics flips that model on its head.

Instead of storing biometric data in a retrievable form, Keyless’ technology uses cryptographic proofs that confirm identity without ever revealing or reconstructing the biometric itself. Re-verification happens in under 300 milliseconds, with a single glance—and without creating a honeypot of sensitive data.

This isn’t incremental innovation. It’s a redefinition of what “strong authentication” means when AI is capable of spoofing almost everything else.

What Zero-Knowledge Biometrics™ Really Changes

Zero-Knowledge Biometrics™ (ZKB) is a new class of authentication developed by Keyless, now part of Ping Identity, that eliminates the long-standing trade-off between security, usability, and privacy. By combining advanced cryptographic proofs with biometric signals, ZKB verifies that a user is who they claim to be—without ever storing, exposing, or reconstructing biometric data.

The result is strong, frictionless authentication that works across devices and journeys, while ensuring user privacy is preserved by design, not by policy.

AI Attacks Demand Continuous Verification

As Andre Durand (CEO of Ping Identity) rightly points out, AI is accelerating identity-based attacks. The response cannot be more friction, layered onto already fragile user journeys. Enterprises don’t win by making authentication harder; they win by making verification smarter.

Zero-Knowledge Biometrics enables something legacy MFA cannot: continuous, privacy-preserving re-verification across the entire identity lifecycle—onboarding, access, step-up, and recovery. It ensures the originally verified person is still the one interacting with the system, even as threat conditions change.

In other words, identity assurance becomes dynamic rather than episodic.

This shift isn’t happening in isolation.

Across the globe, policymakers are converging on a common conclusion: trust must be engineered into AI systems by design. In 2024 alone, global cooperation on responsible AI accelerated, with major institutions—including the OECD, European Union, United Nations, and African Union—publishing frameworks that elevate transparency, explainability, and trustworthiness from ethical aspirations to operational expectations.

Identity sits at the center of that equation.

 If organizations cannot reliably verify who is interacting with AI-enabled systems—without collecting or exposing irreversible personal data—then no amount of governance language will translate into real-world trust.

Privacy Is No Longer Optional—It’s Strategic

Regulatory pressure is rising globally, from GDPR and CCPA to eIDAS 2.0 and the emerging PSD3.

But compliance is only the floor—not the ceiling.

Regulators are no longer treating identity and authentication as implementation details—they are treating them as systemic risk. Under GDPR, biometric data is classified as “special category” data, requiring explicit justification, minimization, and heightened protection, with fines reaching up to 4% of global annual revenue. In the U.S., CCPA and its successor CPRA have accelerated a wave of state-level privacy laws, expanding consumer rights over how personal and biometric data is collected, stored, and shared. Meanwhile, Europe’s eIDAS 2.0 reframes digital identity as a foundational trust layer for cross-border services, while the proposed PSD3 elevates strong customer authentication and fraud prevention from best practice to regulatory mandate—particularly in high-risk digital and financial transactions.

 

Image source: Usercentrics

But regulation isn’t the real pressure point. Liability is. When biometric data becomes irrevocable and attackers are AI-powered, storing identity secrets becomes a long-term business risk. Compliance may define the minimum standard—but privacy-preserving architectures are quickly becoming the only defensible one.

The real shift is user expectation.

Employees, customers, and partners are increasingly unwilling to trade privacy for access. Any authentication model that requires “trust us, we’ll store your biometrics safely” is fundamentally misaligned with that reality.

As Andrea Carmignani notes, Zero-Knowledge Biometrics enables re-verification without ever exposing biometric data—at any point in the journey. That’s not just privacy by design; it’s trust by architecture.

“What we’re seeing across enterprises is a shift from identity as an access problem to identity as a trust problem,” said Sudipto Ghosh, Head of Global Marketing at Intent Amplify. “In an AI-driven environment, storing irreversible biometric data is no longer just a security risk—it’s a business liability. Architectures like Zero-Knowledge Biometrics redefine trust by proving identity without ever possessing it.”

Why This Matters Beyond Biometrics

Ping’s move also strengthens its broader “One Platform” strategy. By integrating device-independent biometric re-verification, Ping extends identity assurance across customer, workforce, and B2B use cases—including shared devices and frontline environments where traditional MFA routinely fails.

The implications are significant:

  • Passwordless authentication without sacrificing security
  • Seamless single sign-on backed by continuous verification
  • Faster recovery from account compromise
  • Stronger defenses against AI-powered fraud
  • Reduced friction at the most critical user moments

This is identity security evolving from access control to trust orchestration. For CISOs and boards alike, identity is centered between IT control and systemic business risks.

The New Baseline for Digital Trust

The uncomfortable truth for enterprises is this: if your identity strategy assumes that yesterday’s authentication guarantees today’s legitimacy, you are already behind.

Zero-Knowledge Biometrics doesn’t just raise the bar—it resets it. It acknowledges that in an AI-saturated world, trust must be verified continuously, cryptographically, and without compromising user privacy.

Sudipto added, “The future of identity isn’t about collecting more data—it’s about proving trust with less. Zero-Knowledge Biometrics signals where the market is heading: stronger assurance, lower risk, and privacy by default.”

Ping Identity’s acquisition of Keyless signals where the industry is heading next. The question is no longer whether enterprises will adopt privacy-preserving, AI-resilient identity models—but how quickly they can afford to get there.

In the age of AI, trust isn’t something you grant once.

It’s something you must prove—again and again—without ever exposing what matters most.

FAQs

1. Why are traditional biometric systems becoming a regulatory and business risk?

Traditional biometrics rely on storing sensitive biometric data in centralized or recoverable formats. Under regulations like GDPR and CPRA, biometric data is classified as high-risk personal data, meaning breaches carry severe financial, legal, and reputational consequences. In an era of AI-powered spoofing and deepfakes, storing irrevocable identity data has shifted from a security advantage to a long-term liability.

2. How does Zero-Knowledge Biometrics™ support compliance without increasing friction?

Zero-Knowledge Biometrics™ verifies identity using cryptographic proofs rather than stored biometric templates. Because biometric data is never stored, exposed, or reconstructable, organizations can meet strong authentication and privacy requirements simultaneously—supporting regulations like GDPR, eIDAS 2.0, and emerging PSD3 frameworks while delivering fast, frictionless user experiences.

3. Is Zero-Knowledge Biometrics about replacing MFA or strengthening it?

It strengthens MFA by evolving it. Zero-Knowledge Biometrics™ enables continuous, privacy-preserving re-verification across the identity lifecycle—onboarding, access, step-up, and recovery. This allows enterprises to move beyond static, one-time authentication toward dynamic identity assurance that is resilient against AI-driven fraud and impersonation.

To participate in upcoming interviews, please reach out to our CyberTech Media Room at info@intentamplify.com.