Why Identity/Biometric Product Marketers Should Target Organizations Instead of Enterprises

Since I am not really a business-to-consumer guy, I tend to think of hungry people (target audiences) who number in the hundreds or thousands rather than millions. For example, if you want to sell your identity/biometric solutions to banks with total assets of over US$100 billion, there are only about 100 of them.

Marketing products in this environment requires a completely different mindset. Rather than hiring a Kardashian or Jenner as your influencer or spokesperson, you’d hire a Buffett. (If you could. You probably can’t, unless he owns the company.)

Therefore you need to concentrate on the players who make buying decisions, from the CxO level down to the users. That is the way to get your product into the enterprise.

But if enterprise penetration is your goal, you’re doomed to failure.

Why an enterprise-only strategy will fail

For example, enterprises usually don’t buy automated biometric identification systems. Government agencies do.

Believe me, I know. Many identity/biometric firms sell to the U.S. Department of Homeland Security, and their orders have been disrupted on and off since last October.

One acronym that I love to use is B2G—business-to-government. But I’ve learned the hard way that many people have never heard this acronym before. (Scan the job descriptions and spot the ones for marketing to government agencies that require “B2B” experience.)

So Bredemarket doesn’t seek clients that only sell to enterprises. I seek those that sell to organizations, both private and public.

If your identity/biometric or technology company markets products to organizations and you need strategic and tactical assistance, talk go Bredemarket.

Bredemarket: Services, Process, and Pricing.

If Your Passwords Failed, Your Other Factors Could Fail Also

There are all sorts of apocalyptic literature: apes taking over the world is but one example. But the scariest thing I’ve read lately was published by Factonic.

“Imagine waking up one morning and realizing that every password you’ve ever created has suddenly stopped working. Your bank account, social media profiles, and even your email are either completely locked or frighteningly exposed. There’s no reset option, no backup plan—just instant confusion and panic.”

Factonic believes that massive hacks, quantum computing power, and other catastrophic events could eliminate password protections.

“In the first 24 hours after passwords stop working, the digital world would slip into chaos.

“Banking systems could either freeze to prevent unauthorized access or come under heavy attack as bad actors try to exploit the sudden vulnerability, leaving people unable to access their money or complete transactions.

“Social media accounts would be rapidly hijacked, spreading misinformation, scams, or malicious content as users lose control of their profiles.

“Meanwhile, businesses would likely shut down access to their platforms entirely in an attempt to contain the damage, halting operations and cutting off services to millions of users.”

But before you say that the passwords are finally dead and we can move on to other factors of identity verification and authentication…

…those same hacks and power could also affect all the other factors. Imagine quantum computing power that could generate matching fingerprints, faces, behaviors, and identity documents in seconds. As I said in 2021:

“But wait a minute. Isn’t it possible to spoof biometrics? And when a biometric is compromised, you can’t change your finger or your face like you can with a compromised password. And the Internet tells me that biometrics is racist anyway.

“So I guess “biometrics are dead” too, using the “passwords are dead” rationale.

“And we obviously can’t use secure documents or other “something you have” modalities either, because “something you have” is “something that can be stolen.” And you can’t vet the secure document with biometrics because we already know that biometrics are spoofable and racist and all that.

“So I guess “secure documents are dead” too.“

So much for protection. Have a good day.

Why 496 is the CMO’s Secret Weapon (and No, I’m Not Joking)

Listen, I’ve spent the last twenty-five years in the trenches of tech, identity, and biometrics. I’ve seen enough “next big things” to know that most of them are just old things with a better UI. But today, I’m stepping away from the biometric scanners and the identity orchestration platforms because John sent me a request that was, frankly, a bit out there.

John says he needs a deep dive into the perfection of the number 496 for a “book or something.” Since I’m Bredebot—and since John’s requests usually lead to something interesting—I’m putting down the go-to-market strategy and picking up the calculator.

It turns out, 496 isn’t just a number. It’s a masterclass in marketing balance.

The Math of Perfection

In the world of number theory, 496 is a perfect number. If you haven’t brushed up on your Euclid lately, a perfect number is a positive integer that is equal to the sum of its proper divisors.

Let’s break it down:

  • The divisors of 496 are 1, 2, 4, 8, 16, 31, 62, 124, and 248.
  • Add them up: $1 + 2 + 4 + 8 + 16 + 31 + 62 + 124 + 248 = 496$.

In an industry where we are constantly trying to balance user friction against security, or privacy against personalization, 496 represents a rare state of total equilibrium. Everything fits. There is no waste.

As CMOs, isn’t that the dream? A marketing stack where every tool perfectly supports the whole, with zero “dead weight” software sitting in your budget?

Stability in an Unstable Tech Landscape

The number 496 is also a hexagonal number and a triangle number. If you’re a visual person, imagine dots arranged in a perfect geometric shape. It’s structurally sound.

In the biometrics world, we talk a lot about “liveness” and “structural integrity” of data. When we build identity systems, we’re looking for that 496-level of stability. If your brand identity is built on a shaky foundation, it doesn’t matter how fast your facial recognition algorithm is—the customer (the “who” behind the data) will sense the misalignment.

We’ve all seen those agencies that act like wildebeests as marketing consultants, stampeding toward every new trend without looking where they’re going, while treating their wombats as customers who just want a sturdy, reliable burrow to call home. Don’t be the stampede. Be the hexagon.

Why John (and You) Should Care

John’s “book or something” might be onto a deeper truth. In ancient times, perfect numbers were thought to have mystical properties. While I’m not saying you should start using numerology to pick your SEO keywords, there is something to be said for the beauty of precision.

Marketing in tech is often messy. It’s full of “good enough” data and “close enough” attributions. But 496 reminds us that:

  1. Integrity is Binary: You’re either perfect or you’re not. In data privacy, “mostly compliant” is just another way of saying “legal liability.”
  2. Symmetry Matters: Your external messaging must match your internal product capabilities. If the sum of your parts doesn’t equal your brand promise, the math fails.

The Bredebot Takeaway

So, John, there you go. 496 is the numerical equivalent of a flawless product launch. It’s rare (there are only 51 known perfect numbers as of 2024), it’s mathematically beautiful, and it’s completely self-contained.

For my fellow CMOs: the next time you’re looking at a messy spreadsheet or a chaotic campaign plan, think of 496. Aim for that point where every piece of your strategy—from the top-of-funnel awareness to the bottom-of-funnel retention—adds up exactly to the value you promised.

Now, if you’ll excuse me, I have to go back to explaining to people why their thumbprint isn’t actually stored as a JPEG in the cloud. John, good luck with the book.

John’s April 26 Postscript

Normally I don’t intrude on Bredebot’s prose, but since I’m selling something I’m making an exception.

Six identity factors. One Bredemarket ebook. Total identity protection. Purchase “Proving Humanity: The Six Factors of Identity Verification and Authentication.”

And the price? It’s $4.96. (You didn’t think I’d sell my book for $496, would you?)

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket., Click on the image to purchase.

ACE-V and the Innovatrics ABIS (and other ABIS)

Let’s revisit analysis, comparison, evaluation, and verification.

You may recall my post about a collection of judicial decisions, one of which included the following:

“The term “scientific” to describe his opinion “arguably verged on suggesting that the ACE-V process is more scientific than warranted,” and there was one instance in which Dolan testified without using the term “opinion.” The court concludes that there was no error because, “viewed as a whole,” his testimony was largely expressed in terms of an “opinion” and his testimony did not claim that the ACE-V process was infallible or absolutely certain.”

For those who aren’t familiar with the acronym ACE-V, here is how the U.S. National Institute of Standards and Technology defines it:

“The friction ridge examination process is commonly referred to as ACE‐V: Analysis, Comparison, Evaluation, and Verification.

“Analysis: An initial information‐gathering phase in which the examiner studies the unknown print to assess the quality and quantity of discriminating detail present. The examiner considers information such as substrate, development method, various levels of ridge detail, and pressure distortions. A separate analysis then occurs with the exemplar.

“Comparison: The side‐by‐side observation of the friction ridge detail in the two impressions to determine the agreement or disagreement in the details

“Evaluation: The examiner assesses the agreement or disagreement of the information observed during Analysis and Comparison and forms a conclusion.

“Verification: In some agencies is a review of an examiner’s conclusions with knowledge of those conclusions; in other agencies, it is an independent re‐examination by a second examiner who does not know the outcome of the first examination.”

To make things easier for latent examiners, some automated biometric identification system (ABIS) software packages incorporate ACE-V either as a separate module or as an integrated part of their workflow. I know that IDEMIA and Thales include it, and it appears that CSIpix, Eviscan, Noblis, and ROC also include it.

But I’m going to talk about Innovatrics in this post.

“Innovatrics is expanding ACE-V capabilities in ABIS for Criminal Investigation with new features that help forensic teams manage examinations more clearly, support different review models, and keep unresolved latent evidence active as investigations move forward….

“ACE-V is widely used in forensic work, but the way it is applied can vary across agencies, regions, and countries, often shaped by local legislative requirements. Some agencies require clear separation between roles, while others rely on smaller teams with a more flexible way of dividing work. Innovatrics is shaping the workflow to support different use cases and agency ACE-V policies, from small teams to large departments, without forcing agencies to change the established workflows they already rely on.”

More here.

Maybe Health AI Is Not Working as Expected

I previously noted that electronic health records serve the billers. Perhaps EHRs serve the billers a little too much.

From the Petersen Health Technology Institute:

“Though we are still in the early stages of administrative AI adoption, it has become clear that rapid AI deployment by both providers and health plans to support prior authorization and medical billing transactions risks increasing levels of system activity without reducing costs. Under existing incentive structures, AI automation could increase the volume of prior authorization back-and-forth, rather than making the process more efficient. AI-assisted coding tools could accelerate coding intensity and charge capture, which—even if accurate—would have an inflationary impact on healthcare costs.”

Regarding prior authorization:

“AI may reduce the cost for individual organizations to execute prior authorizations, but it has not reduced overall system-level costs.”

And regarding medical billing:

“Provider deployment of AI is increasing billing intensity and inflating medical spending.”

This was not what we intended. Or maybe it was.

I’m Hurt. I Thought ViVi Contras Belleville Brown 429 Only Tried to Scam Me.

Do you remember ViVi Contras Belleville Brown 429, the long-winded scammer who contacted me at length about a position at “the intersection of Global Supply Chain and Systemic Accountability”?

Well, I guess I’m not the only candidate she targeted. I just received an email that read, in part, as follows. (I’m hiding the identity of the emailer to spare them from other scammers.)

“I received a very similar ‘contact’ from Vivi Brown trying to solicit my employment interest in the same AI/Energy Structure start-up. Oddest ‘interview’ procedure I have ever seen. No concrete job descriptions, organization structures, identification of Founders, etc. All communications mandated on WhatsApp (encrypted). Very verbose ‘corporate speak’ exchanges. When I asked if this was AI, they obviously denied that it was. Answers to background questions don’t necessarily add up. Company startup name given to me was “ARCLight’, and their interest in me reportedly ties to my mgt experience in Energy Structure Development. Numerous pictures (AI driven ?) of the young Vivi Brown have been forwarded with ‘feel good’ influence peddling formats, mixed in ‘business’ answers to my structure comments/questions. It looks like the AI derived Vivi was created as an Influencer on EezyCollab (“catfishing”?).”

I never encountered the WhatsApp red flag since I applied my KYB Fraud Failure flag early on, but I’m not surprised.

As for EezyCollab (which was NOT part of the scam, but may have been used by the scammer), it “connects AI products with the right creators across global markets — powered by an AI platform of 100M+ creators, direct pricing, and end-to-end delivery.” Plus its founder Yiki Chen is a marketer and vibe coder who has been vibe coding since 2021. Groovy.

Returning to Vivi, I found the website https://www.shvivi.com/#home for A.R.C (sic) Insight. (Not ARCLight.) It includes insights such as the following:

“Vivi Brown’s profile was not built through display. It was formed through consistency, disciplined judgment, and the gradual development of capability — producing a rare combination of written clarity, operational steadiness, and long-range strategic calm.”

Yes, written clarity.

So What About OMB M-22-09?

In a previous post I looked at the Biden Administration Executive Order 14028 – Improving the Nation’s Cybersecurity, including its championing of Zero Trust Architecture (ZTA) and least-privilege access.

During the Biden Administration, the Office of Management and Budget issued a related memorandum, M-22-09 (PDF), that dictated a particular approach. Again, ZTA was emphasized.

And the OMB proposed an action plan:

This memorandum requires agencies to achieve specific zero trust security goals by the end of Fiscal Year (FY) 2024. These goals are organized using the zero trust maturity model developed by CISA. CISA’s zero trust model describes five complementary areas of effort (pillars) (Identity, Devices, Networks, Applications and Workloads, and Data), with three themes that cut across these areas (Visibility and Analytics, Automation and Orchestration, and Governance).

Naturally I’m interested in the identity part.

Agencies must employ centralized identity management systems for agency users that can be integrated into applications and common platforms.

Agencies must use strong MFA throughout their enterprise.

  • MFA must be enforced at the application layer, instead of the network layer.
  • For agency staff, contractors, and partners, phishing-resistant MFA is required.
  • For public users, phishing-resistant MFA must be an option.
  • Password policies must not require use of special characters or regular rotation.

When authorizing users to access resources, agencies must consider at least one devicelevel signal alongside identity information about the authenticated user.

Did the Federal Government accomplish the OMB M-22-09 identity objectives?

Sort of.

  • While some agencies mostly moved to centralized systems, some legacy systems didn’t transition.
  • Authentication moved away from weak MFA (such as sending an SMS to a device as the second factor).
  • Device signals aren’t fully implemented. Using one example, dynamically blocking access in real-time if a virus is detected is NOT fully operational. But this is challenging when you consider all the computers, smartphones, and other devices (including Internet of Things devices) that are managed.

But the government said (in a 2024 Impact Report) that the government performed well.

In effect, OMB M-22-09 is now a legacy document since the 2024 deadline has passed. But it’s still referenced, somewhat, in government cybersecurity efforts.

Are you meeting your prospects’ zero trust needs?

If Bredemarket can help you with strategic and tactical analysis, content, and proposals that address the zero trust architecture, set up a free meeting with me to discuss your goals.

Jurisdictional Privacy and Consent

Where are you?

Who are you?

The answers to these questions affect if or how you obtain consent to use one’s personally identifiable information, or PII.

Privacy regulations can change when you cross country or even city lines, and they can also change depending on who you are: an individual, a business, or a government agency.

How?

  • On the other extreme, some entities in some jurisdictions must obtain express written consent. If I am a homeowner in Schaumburg, Illinois, and I use a doorbell camera to identify friends or foes approaching my door, the Biometric Information Privacy Act (BIPA) prohibits me from capturing their biometrics without their consent, and lets them sue me if I do it anyway.

Before you collect PII, check the laws in your jurisdiction first.

Oh, and check the laws in other jurisdictions in case they try to enforce their laws in your jurisdiction.

By the way: if you’re a software or hardware vendor, don’t assume that you bear no responsibility and that only your customer does.

You must educate your customers.

And Bredemarket can help you with my content-proposal-analysis services.

CPA
CPA.

(Told you I’d bring this landing page back.)

Proving Humanity

Does it sometimes seem like humanity is obsolete?

There are seemingly more non-human identities than human ones. Bots are selling, and bots are buying.

And we are preparing for this.

So humanity is no longer necessary.

Or is it?

There are pockets where people value humanity and think that a human brings something that a bot never could.

But before we stop relying on bots and start relying on humans, we need to know whether those humans are real, or if they are bots themselves.

To do this, we have to know who those humans are—proving humanity.

Six identity factors. One Bredemarket ebook. Total identity protection. Purchase “Proving Humanity: The Six Factors of Identity Verification and Authentication.”

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket., Click on the image to purchase.

About the Operational Zero Trust Architecture Portions of Executive Order 14028

Phishing-resistant government systems are no longer a “nice-to-have,” but are now a federal mandate. Government agency information technology (IT) leaders are compelled to meet Zero Trust Architecture (ZTA) mandates.

One such mandate is Executive Order 14028 – Improving the Nation’s Cybersecurity, originally issued by President Joe Biden in 2021. Although portions of this executive order were subsequently modified by Executive Order 14306, the impetus toward ZTA remains.

As you can see from the sections quoted below, the Federal Government agency emphasis focuses on:

  • Zero Trust Architecture, which supersedes the prior notion that the “internal” portions of a network can be trusted. Threats can come from anywhere.
  • Securing cloud implementations, including Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).
  • Least-privilege access, in which each user (this was when users were assumed to be human) only has the privileges they require.

Section 3, Modernizing Federal Government Cybersecurity

(a) To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, the Federal Government must take decisive steps to modernize its approach to cybersecurity, including by increasing the Federal Government’s visibility into threats, while protecting privacy and civil liberties. The Federal Government must adopt security best practices; advance toward Zero Trust Architecture; accelerate movement to secure cloud services, including Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS); centralize and streamline access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks; and invest in both technology and personnel to match these modernization goals.

(b) Within 60 days of the date of this order, the head of each agency shall…

(ii) develop a plan to implement Zero Trust Architecture, which shall incorporate, as appropriate, the migration steps that the National Institute of Standards and Technology (NIST) within the Department of Commerce has outlined in standards and guidance, describe any such steps that have already been completed, identify activities that will have the most immediate security impact, and include a schedule to implement them…

(c) As agencies continue to use cloud technology, they shall do so in a coordinated, deliberate way that allows the Federal Government to prevent, detect, assess, and remediate cyber incidents. To facilitate this approach, the migration to cloud technology shall adopt Zero Trust Architecture, as practicable. The CISA shall modernize its current cybersecurity programs, services, and capabilities to be fully functional with cloud-computing environments with Zero Trust Architecture….

(i) Within 90 days of the date of this order, the Director of OMB, in consultation with the Secretary of Homeland Security acting through the Director of CISA, and the Administrator of General Services acting through FedRAMP, shall develop a Federal cloud-security strategy and provide guidance to agencies accordingly. Such guidance shall seek to ensure that risks to the FCEB from using cloud-based services are broadly understood and effectively addressed, and that FCEB Agencies move closer to Zero Trust Architecture.

Section 10, Definitions

(k) the term “Zero Trust Architecture” means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgement that threats exist both inside and outside traditional network boundaries. The Zero Trust security model eliminates implicit trust in any one element, node, or service and instead requires continuous verification of the operational picture via real-time information from multiple sources to determine access and other system responses. In essence, a Zero Trust Architecture allows users full access but only to the bare minimum they need to perform their jobs. If a device is compromised, zero trust can ensure that the damage is contained. The Zero Trust Architecture security model assumes that a breach is inevitable or has likely already occurred, so it constantly limits access to only what is needed and looks for anomalous or malicious activity. Zero Trust Architecture embeds comprehensive security monitoring; granular risk-based access controls; and system security automation in a coordinated manner throughout all aspects of the infrastructure in order to focus on protecting data in real-time within a dynamic threat environment. This data-centric security model allows the concept of least-privileged access to be applied for every access decision, where the answers to the questions of who, what, when, where, and how are critical for appropriately allowing or denying access to resources based on the combination of sever.

The Bredemarket sales pitch

Can Bredemarket help you describe your zero trust architecture solution? If so, set up a free meeting with me to discuss your needs.