Illustrating Fear, Uncertainty, and Doubt for Facility Monitoring

I just ran across an excellent example of how a content marketing expert can raise fear, uncertainty, and doubt (FUD) in the mind of a prospect in the “consideration” phase.

These prospects need people to monitor their facilities and protect them against threats. In today’s world, it’s technically possible for facility monitoring professionals to work from anywhere, including their own homes.

Rapid Response Monitoring wants to discourage this.

Our preparation gives us the endurance to continuously provide professional monitoring services from within our hardened facilities. Since our founding, our choice has been to keep critical monitoring operations staff on-site. Monitoring from home provides lower-quality service (security issues/distractions). We believe you deserve more.

From https://www.rrms.com/in-facility-monitoring/

Now Rapid Response Monitoring writes a lot more about why its solution is better, and you can read those words here.

But what about pictures?

There is a relationship between words and pictures, with the most famous relationship expressed as “a picture is worth a thousand words.” (Artists may say that a picture is worth many more words.)

Take a look at Rapid Response Monitoring’s picture and see what this communicates to prospects in the consideration phase for facility monitoring services.

The Difference Between Identity Assurance Levels 2 and 3

It’s been years since I talked about Identity Assurance Levels (IALs) in any detail, but I wanted to delve into two of the levels and see when IAL3 is necessary, and when it is not.

But first, a review

If the term “identity assurance level” is new to you, let me reprint what they are. This is taken from my December 3, 2020 post on identity assurance levels and digital identity.

The U.S. National Institute of Standards and Technology has defined “identity assurance levels” (IALs) that can be used when dealing with digital identities. It’s helpful to review how NIST has defined the IALs.

Assurance in a subscriber’s identity is described using one of three IALs:

IAL1: There is no requirement to link the applicant to a specific real-life identity. Any attributes provided in conjunction with the subject’s activities are self-asserted or should be treated as self-asserted (including attributes a [Credential Service Provider] CSP asserts to an [Relying Party] RP). Self-asserted attributes are neither validated nor verified.

IAL2: Evidence supports the real-world existence of the claimed identity and verifies that the applicant is appropriately associated with this real-world identity. IAL2 introduces the need for either remote or physically-present identity proofing. Attributes could be asserted by CSPs to RPs in support of pseudonymous identity with verified attributes. A CSP that supports IAL2 can support IAL1 transactions if the user consents.

IAL3: Physical presence is required for identity proofing. Identifying attributes must be verified by an authorized and trained CSP representative. As with IAL2, attributes could be asserted by CSPs to RPs in support of pseudonymous identity with verified attributes. A CSP that supports IAL3 can support IAL1 and IAL2 identity attributes if the user consents.

For purposes of this post, IAL1 is (if I may use a technical term) a nothingburger. It may be good enough for a Gmail account, but these days even social media accounts are more likely to require IAL2.

And it’s worthwhile to mention (as I did before) that in practice, IAL3 may not require physical presence.

IAL3: In-person or supervised-remote identity proofing is required.

From https://id4d.worldbank.org/guide/levels-assurance-loas

So what’s the practical difference between IAL2 and IAL3?

If we ignore IAL1 and concentrate on IAL2 and IAL3, we can see one difference between the two. IAL2 allows remote, unsupervised identity proofing, while IAL3 requires (in practice) that any remote identity proofing is supervised.

Designed by Freepik.

Much of my time at my previous employer Incode Technologies involved unsupervised remote identity proofing (IAL2). For example, if a woman wants to set up an account at a casino, she can complete the onboarding process to set up the account on her phone, without anyone from the casino being present to make sure she wasn’t faking her face or her ID. (Fraud detection is the “technologies” part of Incode Technologies, and that’s how they make sure she isn’t faking.)

From https://www.youtube.com/watch?v=w4Y725Pn5HE

But what if you need supervised remote identity proofing for legal or other reasons? Another company called NextgenID offers this.

From https://www.youtube.com/watch?v=ykDdCgkrMKs

But is this good enough? Yes it is, according to Nextgen.

SRIP provides remote supervision of in-person proofing using NextgenID’s Identity Stations, an all-in-one system designed to securely perform all enrollment processes and workflow requirements. The station facilitates the complete and accurate capture at IAL levels 1, 2 and 3 of all required personal identity documentations and includes a full complement of biometric capture support for face, fingerprint, and iris.

From https://www.nextgenid.com/markets-srip.php

Now there are some other differences between IAL2 and IAL3 in terms of the proofing, so NIST came up with a handy dandy chart that allows you to decide which IAL level you need.

From NIST Special Publication 800-63
Revision 3
, Section 6.1 “Selecting IAL.”

When deciding between IAL2 and IAL3, question 3 in the table above is the most critical. NIST explains the purpose of question 3:

At this point, the agency understands that some level of proofing is required. Step 3 is intended to look at the potential impacts of an identity proofing failure to determine if IAL2 or IAL3 is the most appropriate selection. The primary identity proofing failure an agency may encounter is accepting a falsified identity as true, therefore providing a service or benefit to the wrong or ineligible person. In addition, proofing, when not required, or collecting more information than needed is a risk in and of itself. Hence, obtaining verified attribute information when not needed is also considered an identity proofing failure. This step should identify if the agency answered Step 1 and 2 incorrectly, realizing they do not need personal information to deliver the service. Risk should be considered from the perspective of the organization and to the user, since one may not be negatively impacted while the other could be significantly harmed. Agency risk management processes should commence with this step.

From https://pages.nist.gov/800-63-3/sp800-63-3.html#sec6

Even with the complexity of the flowchart, some determinations can be pretty simple. For example, if any of the six risks listed under question 3 are determined to be “high,” then you must use IAL3.

But the whole exercise is a lot to work through, and you need to work through it yourself. When I pasted the PNG file for the flowchart above into this blog post, I noticed that the filename is “IAL_CYOA.png.” And we all know what “CYOA” means.

But if you do the work, you’ll be better informed on the procedures you need to use to verify the identities of people.

One footnote: although NIST is a U.S. organization, its identity assurance levels (including IAL2 and IAL3) are used worldwide, including by the World Bank. So everyone should be familiar with them.

Is Bredemarket on Your Favorite Social Platform?

(This is outdated. See the May 15, 2024 update.)

If you’re starting out in business, you’ve probably heard the advice that as your business branches out into social platforms, you shouldn’t try to do everything at once. Instead you should make sure that your business offering is really solid on one platform before branching out into others.

Yes, I’ve been naughty again and didn’t listen to the expert advice.

One reason is because of my curiosity. With one notable exception, I’m intrigued with the idea of trying out a new platform and figuring out how it works. Audio? Video? Let’s try it.

And as long as I’m trying it out, why not create a Bredemarket account and put content out there?

So there’s a reasonably good chance that Bredemarket is already on one of your favorite social platforms. If so, why not subscribe to Bredemarket so that you’ll get my content?

Here’s a list of Bredemarket’s text, image, audio, and video accounts on various social platforms. Be sure to follow or subscribe!

  • Apple Podcasts (link here)
  • Google Podcasts (link here)

Which Words Should Your Marketers Use? My Four Suggestions.

I’ve talked about the words “why,” “how,” and “what” and their relation to writing, but I haven’t talked about the word “which.”

Not in relation to sandwiches, but in relation to words.

If you are a marketing executive, you know that the words you use in your marketing content can make or break your success. When your company asks employees or consultants to write marketing content for you, which words should they use?

Here are four suggestions for you and your writers to follow.

  1. Your writers should use the right words for your brand.
  2. Your writers should use the right words for your industry.
  3. Your writers should use words that get results.
  4. Your writers should be succinct.

Your writers should use the right words for your brand

Your company has a tone of voice, and your writers should know what it is. If you can’t tell them what it is, they will figure it out themselves.

Your company has a particular writing style—hopefully one that engages your prospects and customers. Regardless of your writer’s personal style, they must create copy that aligns with your own style. In effect, they put on a “mask” that aligns the words they create with the words that your company needs.

Your writers should use the right words for your industry

Similarly, your company provides products and services in one or more industries, and your copy must align with the terms those industries use, and the way industry participants express themselves.

For example, a writer who is writing content for the biometric industry will use different terms than a writer who is writing content for art collectors because of the differences in the two target audiences.

  • Biometric readers (the people, not the devices) care about matching accuracy measurements, such as those compiled by the U.S. National Institute of Standards and Technology (NIST) in its Face Recognition Vendor Test, or as measured in agency-managed benchmarks. (Mike French’s example.) They often respond to quantitative things, although more high-level concepts like “keeping citizens safe from repeat offenders” (a public safety-related benefit) also resonate.
  • Art collectors care about more qualitative things, such as not being scared of handing over their dream to a commissioned artist whose work will inspire affection. (Well, unless the collector is an art investor and not an art lover; investors use different terminology than lovers.)

So make sure your writers get the words right. Otherwise, it’s as if someone is speaking Italian to a bunch of French speakers. (Kaye Putnam’s example.) Your prospects will tune you out if you use words they don’t understand.

Your writers should use words that get results

There is one important exception to my suggestions above. If your company’s current words don’t result in action, quit using your current words and use better ones that support your awareness, consideration, conversion, or other goals.

If you start talking about your solution without addressing your prospect’s pain points or problems, they won’t know why they should care about your solution.

For example, let’s say that the message you want to give to your prospects is that your company makes wireless headphones.

So what?

The prospect doesn’t care about wireless headphones per se. The prospect cares about the troubles they face with tangled cords, and how your company offers a solution to their problem of tangled cords.

Features are important to you. Benefits are important to your prospects. Since the prospects are the ones with the money, listen to them and talk about benefits that change their lives, not how great your features are.

Your writers should be succinct

I have struggled with succinctness for decades. I could give you countless examples of my long-windedness, but…that wouldn’t be appropriate.

So how do I battle this personally? By creating a draft 0.5 before I create my draft 1. I figure out what I’m going to say, say it, and then sleep on the text—sometimes literally. When I take a fresh look at the text, I usually ruthlessly chop a bunch of it out and focus on the beef.

Now there are times in which detail is appropriate, but there are also times in which a succinct message gets better results.

Selecting your content marketer

If your company needs employees or consultants to write marketing content for you, make sure they create the right content.

If your company’s views on content creation parallel my own, maybe I can help you.

If you need a full-time employee on your staff to drive revenue as your personal Senior Product Marketing Manager or Senior Content Marketing Manager, take a look at my 29 years of technology (identity/biometric) and marketing experience on my LinkedIn profile. If you like what you see, contact me via LinkedIn or at jebredcal@gmail.com.

If you need a marketing consultant for a single project, then you can reach me via my Bredemarket consultancy.

How Non-Commodity Content Creators Collaborate with Clients

On Friday, I shared a Kaye Putnam video on my Bredemarket LinkedIn page.

While I won’t go into all of the video details here (you should spend a few minutes and watch Putnam’s video yourself), one of the points that Putnam made was that the best content creators need to differentiate themselves from commodity content providers—in other words, to “be irreplaceable.”

If it’s not obvious how your product or service is wildly different, not just better, your ideal clients will resort to looking at you like a commodity.

Kaye Putnam, from the transcript to https://www.youtube.com/watch?v=jNGos1kVIdM

One of the ways in which content creators can differentiate themselves from their competition is to have a unique process.

In addition to having the emotional appeal and positioning that we already talked about, you can employ tools like having a proprietary process. A unique way of achieving a desired result.

Kaye Putnam, from the transcript to https://www.youtube.com/watch?v=jNGos1kVIdM

I’d like to look at one such process, the process in which a content creator collaborates with a client, but I’d like to take a look at how two very different content creators achieve the same outcome.

How Bredemarket collaborates with clients

One of the many differentiators between Bredemarket and its marketing and writing competitors is the way that Bredemarket kicks off projects.

Before I work with you, I ask a series of questions to better understand what you need.

(UPDATE OCTOBER 23, 2023: “SIX QUESTIONS YOUR CONTENT CREATOR SHOULD ASK YOU IS SO 2022. DOWNLOAD THE NEWER “SEVEN QUESTIONS YOUR CONTENT CREATOR SHOULD ASK YOU” HERE.)

Now these are not all of the questions that I ask. After all, my process is, um, “Bredemarket-developed.” (I avoid the word “proprietary” because of its negative connotations.) But the limited number of questions that I did share suggests how I try to understand you. Why you do what you do. How you do it. And so forth.

(If you are interested in this topic, I have written an entire e-book focused on the first six questions that I ask you. To download the e-book, visit my blog post “Six Questions Your Content Creator Should Ask You: the e-book version.”)

In true Putnam manner, I approach this entire process as a Sage, or someone who imparts wisdom which, when combined with your wisdom, results in an effective piece of content.

Yes, this is a Rembrandt painting, anticipating the next section of the blog post. By Rembrandt – The Yorck Project (2002) 10.000 Meisterwerke der Malerei (DVD-ROM), distributed by DIRECTMEDIA Publishing GmbH. ISBN: 3936122202., Public Domain, https://commons.wikimedia.org/w/index.php?curid=157824

But not everyone is a Sage, and other content creators approach collaboration differently.

How Paso Artis collaborates with clients

As I’ve frequently said, my primary emphasis is words. My graphic execution capabilities are somewhat limited.

I did not draw this myself. Originally created by Jleedev using Inkscape and GIMP. Redrawn as SVG by Ben Liblit using Inkscape. – Own work, Public Domain, link.

But there are many, many people who have better graphic execution capabilities than I do.

One such person is the artist behind Paso Artis.

Now I don’t know Paso Artis’ personal archetypes, but I’d be willing to bet that her primary archetype isn’t Sage. The obvious guess for her primary archetype is “Creator.”

Get ready to celebrate the power of your creative brand archetype! Whether you resonate with being an Artist, musician, writer, dreamer, builder, or designer, your brand has the incredible ability to amaze and inspire others.

When customers encounter your creative brand, they can’t help but feel captivated. They look at your work and think, “I want to be able to do what they can.” Your brand ignites a spark of inspiration and ignites the imagination within those who connect with it.

One of your innate advantages as a creative brand is your boundless creativity and imagination. You possess the unique ability to see the world in a different light, to think outside the box, and to breathe life into your visions.

Kaye Putnam, from https://www.kayeputnam.com/brand-archetype-creator/

A few of you may recall that I initially thought that I was a “Creator,” until I realized that this archetype applies more to imagery rather than words. And not stick figures.

Despite our vast differences, Paso Artis and Bredemarket have one similarity.

  • We both work together with our clients to create a piece of content that satisfies the clients’ needs.
  • With Bredemarket, it’s a written piece of content.
  • With Paso Artis, it’s a custom painting.

But because Paso Artis is…well, an artist, she doesn’t use Sage-like words and tables and bullet points to describe her client collaboration process. The Paso Artis-developed (again, I don’t like the word “proprietary”) collaboration process is described much more…artistically.

As an artist, I do feel the responsibility and privilege of taking a vision and turning it into a painting that will hang on the wall for years and be seen every day and regarded with affection.

Don’t be scared of handing over your dream to me.

In order to achieve a happy outcome, you and I will work together.

From https://www.facebook.com/paso.artis/about_details

Note that Paso Artis uses some words that Bredemarket never uses, such as “affection” and “dream.” Now I might use “vision” and “scared” in the proper context, but most of my clients and prospects do not dream of having their customers regard their products and services, or their blog posts or white papers, with affection. Even the Bredemarket client who chose to “truly say thank you for putting these (proposal) templates together” didn’t get affectionate about them. I mean, I love Microsoft Word, but I don’t LOVE Microsoft Word.

So Bredemarket and Paso Artis use a different vocabulary. This happens to come back to another point that Putnam made, to speak the language of your clients.

If you only know Italian and your ideal clients are speaking French, you might get a few people that understand what you mean, but it’s not going to have the transformative effect that we’re looking for. You want to learn to be fluent. In the decision making language of your ideal clients.

Kaye Putnam, from the transcript to https://www.youtube.com/watch?v=jNGos1kVIdM

Marketers, imagine if you will a possible persona for a Paso Artis prospect.

By David Teniers the Younger – 1. Kunsthistorisches Museum Wien, Bilddatenbank.2. khm.at, Public Domain, https://commons.wikimedia.org/w/index.php?curid=659517

“Jay” is a homeowner who loves art and desires a particular type of painting for his home, but does not have the artistic talent to paint it himself. Ideally, the completed painting will be one that brings Jay delight when he sees it in his home, and will also delight his guests. But can he trust anyone to realize his dream?

So Paso Artis (who has years of marketing experience in her day job work) knows that she has to address Jay’s pain points. She first does this by addressing them in her “About” text (“Don’t be scared of handing over your dream to me”), but then addresses them more deeply during her consultation with Jay.

I have never performed a competitive analysis of artists who respond to commission requests, but I’d guess that some are better at collaborating with clients than others.

And the ones that collaborate well earn a positive reputation, which translates to increased revenue over those who don’t collaborate well.

How should YOU collaborate?

But of course Bredemarket doesn’t matter, and Paso Artis doesn’t matter. You matter.

When you collaborate with a partner, either one in which the partner provides a product or service to you, or you provide a product or service to the partner, make sure that both of you are on the same page (or easel) before launching into the work project.

And if you have a dream for a painting, contact Paso Artis via her Facebook page.

And if you want your blog posts, white papers, case studies, and other content to be regarded with affection (or something like that), contact Bredemarket.

On Benefits, Features…and Advantages

I’m trying to flesh out the usefulness of the Bredemarket website.

  • Initially, much of the content was benefit-focused.
  • As the website matured, I began to include and flag more information on features—not only as features relate to benefits, but also discussing features independent of benefits (example: my discussion of the Touch ID feature).
  • It’s time to throw one other term into the mix.

Using bad statistics, addition of a third term to the two existing terms improves bredemarket.com by a whopping 50%.

Not bad for (more than) 5 minutes of work.

Review of features and benefits

The home page for the product management platform provider Airfocus, https://airfocus.com/

Airfocus has published an article about…well, I’m not going to reveal the title yet, because that gives away the massive surprise ending.

(Whoops; I already revealed it. Pay no attention to the title behind the blog post.)

For now, I’ll just say that the article discusses features and benefits.

Here’s how Airfocus defines features (which coincides with my own definition of features):

(Features) are characteristics that a product or service has. It is a simple statement about attributes. 

For example: ‘An automated photo storage app that edits, selects and stores photos’ 

From Airfocus

Contrast this definition of features with Airfocus’ definition of benefits (which again coincides with my own definition of benefits):

A benefit…is why a prospect would ultimately use a product.

This key benefit provides an emotional hook point that you can leverage in helping the user imagine the positive experiences felt by using your product. 

For example: ‘If you don’t waste your time editing and can store more of your best photos, you’ll keep happier memories for longer’.

From Airfocus

So again, the feature is a characteristic of a product (or what the product does), while a benefit explains why that characteristic is important to a prospect.

This is good in and of itself, and has served me well for years. I could stop right here, but I’ve just passed 400 Bredemarket blog posts and am on a roll to get up to 500.

So I’m going to tell you that Airfocus expands the feature-benefit model by defining an middle category between features and benefits.

The stage between a feature and a benefit

Airfocus defines the intermediate step between a feature and benefit as follows:

An advantage is what that feature does, and how it helps. These are factual and descriptive but do not yet make a connection as to how it will make users’ life better. 

For example: ‘It automatically keeps only the clearest picture of a similar set, and deletes the rest. Your photo storage is reduced on average by 80%.

From Airfocus, https://airfocus.com/glossary/what-is-a-features-advantages-and-benefits-analysis/

So now it’s time for the big surprise. The third word is advantage.

Perhaps I’m oversimplifying the analysis, but the three terms (features, advantages, and benefits) can be related as follows, using my three favorite question adverbs and incorporating Airfocus’ examples:

FeatureWhatAutomated photo storage app
AdvantageHowReduce photo storage 80%
BenefitWhyKeep happier memories for longer
I’ll use this caption to plug my first e-book, which you can get here.

Since I talk about benefits ad nauseum, you may get the mistaken view that features and advantages don’t matter. They do matter—in the proper context. For example, if you’re working on a data sheet or a user manual (if they still exist), you definitely need a feature list and could probably use an advantage list also.

Now do you have to use a feature-advantage-benefit model, instead of the simpler feature-benefit model?

Not at all.

But if you find it helpful, use it.

We Don’t Need Customer Focus Because Our Product Is So Great

It’s always good to question previous thoughts, and that’s what I’m doing right now.

In the past, I’ve stated that the best way to attract awareness (and eventually revenue) is to focus on customers and their needs.

But what if I’m wrong? (I’ve been wrong before.)

The benefits of product focus

What if a stellar product is all that is needed to attract business and gain revenue?

After all, aren’t the benefits of a great product obvious at first glance?

If we stop with the claptrap of understanding our target audiences and pain points and stuff, and just focus on ourselves and our great product, we’ll have a clearly focused message…

…um…

…that no one will give a hoot about.

“OK, I’m glad that your Super Duper Gizmo is so great, but so what? What’s in it for me? Why should I care?”

Never mind.

From https://www.youtube.com/watch?v=OjYoNL4g5Vg

I guess I was right when talking about customer focus.

Sure, talk about your product, but start with the customer first and their needs. Then say how your product benefits the customer, exceeds their needs, and delights them.

(So why did I write this piece of content? Neil Patel’s Ubersuggest…um, suggested that my website needed yet another article on customer focus. I thought I’d do something a little different this time.)

Insight

From https://open.spotify.com/track/2lyHCMlRtEeHlLYFuGGlZB?si=nIFe0l4NSbm1DGQU-8YbnQ&pi=FfNgkCWyQ0i2

When you deal with WordPress enough, this song pops into your head.

From https://open.spotify.com/track/2lyHCMlRtEeHlLYFuGGlZB?si=MpxHgffcQYS36GfuUqNocA

So what is my, um, insight into this song from Depeche Mode’s “Ultra” album?

That it’s a wonder that the song, and the album, was ever released. One member had already quit the band, and the other three were all dealing with personal issues. (Not just Dave.)

But they DID release the album, and this configuration of the band released several additional albums over the next…quarter century.

Sometimes we are surprised by what we can do.

I’m talking to you now.

Bredemarket’s Name for the Sixth Factor of Authentication

Depending upon whom you ask, there are either three or five factors of authentication.

Unless you ask me.

I say that there are six.

Let me explain.

First I’ll discuss what factors of authentication are, then I’ll talk about the three factor and five factor school, then I’ll briefly review my thoughts on the sixth factor—now that I know what I’ll call it.

What are factors of authentication?

Before proceeding to factors of authentication, let’s review TechTarget’s definition of authentication.

Authentication is the process of determining whether someone or something is, in fact, who or what it says it is.

From https://www.techtarget.com/searchsecurity/definition/authentication

For purposes of this post I’m going to stay away from the “something” part and concentrate on the “someone” part.

For example, if Warren Buffett has a bank account, and I claim that I am Warren Buffett and am entitled to take money from that bank account, I must complete an authentication process to determine whether I am entitled to Warren Buffett’s money. (Spoiler alert: I’m not.)

So how do I authenticate? There are many different ways to authenticate, which can be grouped into several authentication factors. Here’s how Sumo Logic defines “authentication factor.”

An authentication factor is a special category of security credential that is used to verify the identity and authorization of a user attempting to gain access, send communications, or request data from a secured network, system or application….Each authentication factor represents a category of security controls of the same type. 

From https://www.sumologic.com/glossary/authentication-factor/

When considering authentication factors, the whole group/category/type definition is important. For example, while a certain system may require both a 12-character password and a 4-digit personal identification number (PIN), these are pretty much the same type of authentication. It’s just that the password is longer than the PIN. From a security perspective, you don’t gain a lot by requiring both a password and a PIN. You would gain more by choosing a type of authentication that is substantially different from passwords and PIN.

How many factors of authentication are there?

So how do we define the factors of authentication? Different people have different definitions.

Three factors of authentication

For the most part, I believe that everyone agrees on at least three factors of authentication. As I noted in a prior post on factors of authentication, NIST defines the following three factors:

Factors include: (i) something you know (e.g. password/personal identification number (PIN)); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

From https://csrc.nist.gov/glossary/term/Multi_Factor_Authentication, cited in https://bredemarket.com/2022/03/19/remember-the-newer-factors-of-authentication/

Note that NIST’s three factors are very different from one another. Knowing something (such as a password or a PIN) differs from having something (such as a driver’s license) or being something (a fingerprint or a face).

But some people believe that there are more than three factors of authentication.

Five factors of authentication

Let’s add two factors to the definition trumpeted by NIST. People such as The Cybersecurity Man have included all five in their definition.

  • Something you know.
  • Something you have.
  • Something you are.
  • Something you do.
  • Somewhere you are.

For more information, see my March 2021 post on the five factors of authentication.

But are there only five?

Six factors of authentication

In April 2022, I began wondering if there is a sixth authentication factor. While I struggled to put it into the “some xxx you xxx” format, I was able to encapsulate what this sixth factor was.

What about the authentication factor “why”?

This proposed factor, separate from the other factors, applies a test of intent or reasonableness to any identification request.

From https://bredemarket.com/2022/04/12/the-sixth-factor-of-multi-factor-authentication-you-heard-it-here-first/
Why is this man smoking a cigarette outdoors? By Marek Slusarczyk, CC BY 3.0, https://commons.wikimedia.org/w/index.php?curid=108924712

Over the months, I struggled through some examples of the “why” factor.

  • Why is a person using a credit card at a McDonald’s in Atlantic City? (Link) Or, was the credit card stolen, or was it being used legitimately?
  • Why is a person boarding a bus? (Link) Or, was the bus pass stolen, or was it being used legitimately?
  • Why is a person standing outside a corporate office with a laptop and monitor? (Link) Or, is there a legitimate reason for an ex-employee to gain access to the corporate office?

As I refined my thinking, I came to the conclusion that “why” is a reasonable factor of authentication, and that this was separate from the other authentication factors (such as “something you do”).

And the sixth factor of authentication is called…

You’ll recall that I wanted to cast this sixth authentication factor into the “some xxx you xxx” format.

So, as of today, here is the official Bredemarket list of the six factors of authentication:

  • Something you know.
  • Something you have.
  • Something you are.
  • Something you do.
  • Somewhere you are.

(Drumroll…)

  • Somewhat you why.

Yes, the name of this factor stands out from the others like a sore thumb (probably a loop).

However, the performance of this factor stands out from the others. If we can develop algorithms that accurately measure the “why” reasonableness of something as a way to authenticate identity, then our authentication capabilities will become much more powerful.