Not on most platforms, authentication confirms a credential, not a person. Dispel Identity adds that missing layer directly into the remote access session itself, rather than requiring a separate identity tool bolted on afterward.

MFA stops attacks that rely on a stolen password alone. It doesn't stop an attacker who gets a real employee to approve the login in real time, exactly what vishing campaigns like ShinyHunters' do. Once the credential and the MFA prompt are both handed over, authentication has nothing left to check. Identity proofing adds the missing step: confirming the actual person.

AAL (Authenticator Assurance Level) measures how strongly a credential was authenticated. IAL (Identity Assurance Level) measures how strongly you've proven who the person actually is. Most access tools handle AAL and stop there; Dispel Identity adds IAL2 through government ID validation and a biometric match.

NERC CIP already requires in-person identity verification for physical access to critical assets, but not for the remote sessions that reach those same assets. Dispel Identity extends the same standard to remote access, and because verification is policy-driven, you can require it specifically on high-impact BES Cyber assets without slowing routine work.

No. Verification triggers only where you define it: by user type, asset risk, a behavioral threshold, or geography. Low-risk, routine sessions aren't interrupted to catch the rare high-risk one.

Biometric data is processed through an accredited third-party provider and stored in a non-reversible, non-reconstructable format, never as a raw image. Processing stays within US or EU-based infrastructure, with GDPR data minimization and BIPA-compliant consent and retention, so verification doesn't create a new biometric data liability for your organization to manage.