“Every vendor we looked at fell kind of flat when it came to IAL3… no other solution met the expected requirements.”
Mark Lee, Director of Information Security, Appian
Wesley is a synthetic person created by NextgenID. He resembles no real individual. Every credential above was fabricated for this demonstration.
Your most expensive breach will have a name, a résumé, and three references.
- Average breach: $4.99M, a record high.
- 183 days before anyone identifies the breach.
- In July 2026, an FBI official said the Bureau had just identified a North Korean remote IT worker working for the federal government.
- Wesley has already applied to your company.
He would have cleared your badging process too. The same document and the same camera clear the checks that stand between an unknown person and a badge, a credential, or privileged access. NextgenID runs the one check they cannot: an attended session, watched live by a certified agent, on hardware you control.
A certified agent watches every session live. The credential goes to the verified person, not to the person on the paperwork.
Pick where they go.
A PresenceID walk-in site, including USPS locations. Or put a kiosk in your own lobby.
A certified agent joins live and watches the capture.
Face, iris and fingerprint are taken together on NextgenID's own hardware, and the document is verified against more than 6,500 document types. Nothing runs on the applicant's own phone, so there is no camera for an attacker to inject into.
Issue against that session.
A PIV or PIV-I badge, a FIDO2 security key, or a credential on their phone, bound to the person a certified agent watched start to finish. From unknown to certified identity in under seven minutes.
Agents are certified under NextgenID's Kantara-approved IAL3 service, approval IAF-Approval-24.03-KI.
"The people that showed up to work were not the people we interviewed."
r/recruitinghellThat is the title of the thread, written by an engineer who helped interview both of them. Both got the job.
And hiring is only where you notice it. The same gap sits under every badge you issue, every credential you provision, and every account you grant privileged access to. A document and a camera got Wesley through screening. They will get him through badging too.
The poster's update: It looks like we're seriously considering in-person interviews again even if it limits our recruiting pool.
The market's answer to this, right now, is to go backwards.
Don't undo remote hiring to fix a badge problem. Fix the badge.
Who already runs this.
HHS, DHS and Google are customers of NextgenID.
1 in 4 profiles
Gartner predicts that by 2028, one in four candidate profiles worldwide will be fake.
Gartner press release, 31 July 2025
37%
37% of 302 security leaders reported deepfakes in video calls.
Gartner survey, September 2025
741%
Injection attacks targeting iOS rose 741% in 2025.
iProov Threat Intelligence Report, 2026
IAL3
NextgenID is independently certified at IAL3 by Kantara, approval IAF-Approval-24.03-KI, effective 10 June 2024.
This is the real constraint, and it is why the answer is a network rather than an enrollment office. Getting to IAL3 used to mean travel, and coverage got worse rather than better: GAO found "costly and time-consuming travel" for remote employees (GAO-11-751), and after nearly 500 USAccess sites closed during the pandemic, GSA's own example put the nearest site an hour away (GSA, February 2021). PresenceID is a nationwide walk-in network including USPS locations, and you can place your own stations where your people already are.
That is the standard you will be held to, so the station keeps nothing: once the session closes and the identity package reaches your credential system, it is wiped, and only transaction metadata lives on. NextgenID retains no personal data to breach, which matters because a verification vendor's breach becomes yours to explain.
Every loop lands on you as a lost hire and a support queue, not just on their patience. A certified agent is live in every session, so an unusual document or a face that will not read gets resolved by a person while the applicant is still sitting there.
How long could someone who doesn’t exist work at your organization?
Thirty minutes. You'll see a live, supervised session end to end, then we'll walk your own access paths and say plainly which of them Wesley would clear today. Nothing to install, and nothing needed from your applicants.