How can blog posts increase the awareness of your identity/biometric or technology company’s products and services? I’m going to explain how in this blog post.
Imagine there’s a funnel. It’s easy if you try. But this funnel doesn’t stream water, but people. (Or wombats.)
The funnel. Imagen 4.
In this funnel, the people (or wombats) who are potentially interested in your offering—your prospects—start at the very top. The few who actually buy your offering emerge from the bottom.
But how do you get people to enter the funnel and become aware of your offering?
How can blog posts help you?
One great way to let people know about your offering is by blog posts such as this one.
Blogs are a fast way to tell your prospects how your offering can help them. And you can create blog posts very quickly, within days or even hours.
If you want to make prospects aware of your company’s service, write a blog post.
What can Bredemarket offer to you?
One of Bredemarket’s offerings is…writing blog posts for other companies. I can help your identity/biometric or technology company write blog posts so you can get more people to learn about your services.
If you want to learn how I can help your company write blog posts, visit bredemarket.com/mark.
For our purposes, the big difference between IAL2 and IAL3 is that IAL2 allows “either remote or physically-present identity proofing,” while IAL3 requires “[p]hysical presence” for identity proofing. However, the proofing agent may “attend the identity proofing session via a CSP-controlled kiosk or device.” In other words, supervised enrollment.
“IAL3 is reserved for high-risk environments such as sensitive government services.”
How are solutions approved for a particular Identity Assurance Level?
Now I could get on my product marketing soapbox and loudly proclaim that my service is IAL2 compliant, or IAL3 compliant, or IAL4 compliant. (“What? You don’t know about IAL4? Obviously you’re not authorized to know about it.”)
“Available to Credential Service Providers offering Full or Component Credential Management Services. Modeled on best practice (drawing from, among other sources, ISO/IEC 27001, ISO/IEC 29115), this Class of Approval ensures the provider organization’s good standing and management / operational practices and assesses criteria which are derived strictly from NIST SP 800-63 rev.3 requirements, ensuring a conformant technical provision of the provider organization’s service.
You see that the Kantara Initiative doesn’t even offer an approval for IAL1, just for IAL2 and IAL3.
It also offers approvals for AAL2 and AAL3. I’ve previously discussed Authenticator Assurance Levels (AALs) in this post. Briefly, IALs focus on the initial identity proofing, while AALs focus on the authentication of a proven identity.
Component Services IAL2 approvals…and an IAL3 approval
Now if you go to the Kantara Initiative’s Trust Status List and focus on the Component Services, you’ll see a number of companies and their component services which are approved for NIST 800-63 rev.3 and offer an assurance level of IAL2.
With one exception.
“NextgenID Trusted Services Solution provides Supervised Remote Identity Proofing identity stations to collect, review, validate, proof, and package IAL-3 identity evidence and enrollment data for CSPs operating at IAL-3. The NextGenID TSS Identity Stations enable remote operators to remotely supervise NIST SP 800-63A compliant Supervised Remote Identity Proofing (SRIP) sessions for credentialing.”
So if remote identity assurance is not good enough for you, there’s a solution. I’ve already discussed NextgenID’s SUPERVISED remote identity proofing in this post. And there’s a video.
But clearly biometric product marketers are paying attention to the identity assurance levels…at least the real ones (not IAL4). But are they communicating benefit-oriented messages to their prospects?
Biometric product marketing has to be targeted to the right people, with the right message. And the biometric product marketing expert at Bredemarket can help a company’s marketing organization create effective content. Talk to Bredemarket.
“I am currently working as a Temporary Recruiting Assistant, assisting the company in finding a suitable candidate to fill an open position.
“After reading your background information, I believe that you have the experience and abilities that are highly qualified for this position.
“If you are interested in this opportunity, you are more than welcome to get back to me and I will be happy to provide you with more information about the position.
“Thank you for your time and look forward to your reply!
“Amanda Rodriguez
Temporary Recruitment Assistant | Administrative Support in Talent Acquisition”
I don’t know Spencer Stuart but they presumably wouldn’t hire a clown like this, even in a temporary capacity.
Here’s my reply, but the account disappeared before I could send it.
“If you are truly targeting anti-fraud identity verification product marketing professionals, your pitch itself sounds like it was written by a scammer fraudster. Even in his current condition, Kevin Mitnick wouldn’t fall for this scam.”
I’ve frequently talked about geolocation as a factor of authentication, and have also mentioned the privacy concerns that rise with the use of geolocation for identification.
But sometimes it’s not just an issue of privacy, but something more sinister.
Authentic Living Therapy is a counselor specializing in trauma, abuse, emotional abuse, anxiety, depression, self-harm, parenting, and relationship difficulties. The page recently shared an image post on Facebook with the title
“Tracking someone’s location isn’t always about care. Sometimes, it’s about control.”
If you are a tech marketer and want to share how your identity solution protects individual privacy, I can help you write the necessary content. Let’s meet. Before your competition shares ITS story and steals your prospects and revenue.
An authentication factor is a discrete method of authenticating yourself. Each factor is a distinct category.
For example, authenticating with fingerprint biometrics and authenticating with facial image biometrics are both the same factor type, because they both involve “something you are.”
But how many factors are there?
Three factors of authentication
There are some people who argue that there are only really three authentication factors:
Something you know, such as a password, or a personal identification number (PIN), or your mother’s maiden name.
Something you have, such as a driver’s license, passport, or hardware or software token.
Something you are, such as the aforementioned fingerprint and facial image, plus others such as iris, voice, vein, DNA, and behavioral biometrics such as gait.
Somewhat you why, or a measure of intent and reasonableness.
For example, take a person with a particular password, ID card, biometric, action, and geolocation (the five factors). Sometimes this person may deserve access, sometimes they may not.
The person may deserve access if they are an employee and arrive at the location during working hours.
That same person may deserve access if they were fired and are returning a company computer. (But wouldn’t their ID card and biometric access have already been revoked if they were fired? Sometimes…sometimes not.)
That same person may NOT deserve access if they were fired and they’re heading straight for their former boss’ personal HR file.
Or maybe just five factors of authentication
Now not everyone agrees that this sixth factor of authentication is truly a factor. If “not everyone” means no one, and I’m the only person blabbering about it.
So while I still work on evangelizing the sixth factor, use the partially accepted notion that there are five factors.
(Author’s preface: I was originally going to schedule this post for the middle of next week. But by the time I wrote it, the end of the post referenced a current event of astronomical proportions. Since said current event may be forgotten by the middle of next week, I am publishing it now.)
You get a message on a platform from someone you don’t know. The message may look something like this:
“John ,
“I hope this message finds you well. I came across your profile and was truly impressed by your background. While I’m not a recruiter, I’m assisting in connecting talented professionals with a startup that is working on a unique initiative.
“Given your experience, I believe you could be a fantastic fit for their senior consultant role. If you’re open to exploring this opportunity, I’d be happy to share more details and introduce you to the team directly. Please let me know if you’re interested!”
Let’s count the red flags in this message, which is one I actually received on May 30 from someone named David Joseph:
The author was truly impressed by my background, but didn’t cite any specifics about my background that impressed them. This exact same message could be sent to a biometric product marketing expert, a nuclear physicist, or a store cashier.
The author is not a recruiter, but a connector who will presumably pass me on to someone else. Why doesn’t the “someone else” contact me directly?
The whole unidentified startup working on a unique initiative story. Yes, some companies operate as stealth firms before revealing their corporate identity. Amway. Prinerica. Countless MLMs with bad reputations. Trust me, these initiatives are not unique.
That senior consultant title. Not junior consultant. Senior consultant. To make that envelope stuffing role even more prestigious.
I got the note and the note is even clearer
But I wasn’t really concerned with the message. I get these messages all the time.
So what concerned me?
The note attached to the message by the platform that hosted the message.
“Don’t know David? Ask David to verify their profile information before responding for added security.”
The platform, if you haven’t already guessed, is LinkedIn, the message a LinkedIn InMail.
Let’s follow the trail.
LinkedIn let “David” use the platform without verifying his identity or verifying that Randstad is truly his employer as his profile states.
LinkedIn sold “David” a bunch of InMail credits so that he could privately share this unique opportunity.
Now LinkedIn wants me to do its dirty work and say, “Hey David, why don’t you verify your profile?”
Now the one thing in LinkedIn’s favor is that LinkedIn—unlike Meta—lets its users verify their profiles for free. Meta charges you for this.
But again, why should I do LinkedIn’s dirty work?
Why doesn’t LinkedIn prevent users from sending InMails unless their profiles are verified?
The answer: LinkedIn makes a ton of money selling InMails to people without verified profiles. And thus makes money off questionable businesspeople and outright scammers.
Instead of locking down the platform and preventing scammers from joining the platform in the first place.
I never saw the text this person received, but you can tell that it claimed to be from McAfee (it wasn’t) and demanded urgent action, presumably asking the recipient to enter PII including financial information.
People are people, and why should it be that non-person entities (NPEs) are treated the same? The girl is NOT the robot.
Imagen 4.
Non-static
In a June 30 LinkedIn post, Eric Olden of Strata caused me to realize that my approach to NPEs is too uniform and needs to be more nuanced.
“Agentic identity isn’t just a new type of NHI. AI agents might functionally fall under the “non-human identity” umbrella—but that label doesn’t really cut it since we’re not talking about static service accounts or API keys.”
In a table published in the original post, Olden semantically defines NHIs as the persistent entities with unchanging privileges. Agentic identities, in Olden’s cosmos, are ephemeral.
But Olden identifies one additional distinction that has nothing to do with lifespan.
“AI agents are digital actors that can reason and make decisions across systems.”
Olden notes that the characteristics of agentic AI offer both power and risk.
“Modern architectures — cloud-native, ephemeral workloads, APIs, containers, robotic processes — don’t fit neatly into the account model. They’re fast, dynamic, and short-lived. They need access right now, based on who or what they are, where they run, and what they do.
“And here’s the shift: We don’t need to create an account for each of them. We just need to recognize the entity, validate it, and project a governed identity that can be used for access decisions.”
Bredemarket 