Digital identity verification is leaving businesses exposed to risks that emerge after credentials have been approved, with mobile device changes, account recovery and artificial intelligence agents creating new challenges for organisations relying on electronic identity checks, according to Hopae head of trust Junmin (Eric) Kim.

Hopae head of trust Junmin (Eric) Kim, who contributed to the discussion group behind the Kantara Initiative’s Digital Identity Risk Universe (DIRU), published in May 2026, believes businesses are underestimating the risks that emerge after initial identity verification. He argues that organisations must look beyond onboarding to consider how credentials are managed, updated and recovered throughout their lifecycle.

Changes to a user’s device, updates to credential status and requests for unnecessary personal information can all introduce weaknesses into otherwise functioning identity systems. These issues can expose businesses to security incidents even after an initial verification has been completed successfully.

The DIRU framework identifies 163 digital identity risks, including 98 associated with human digital identities and 65 relating to AI agents. It provides a shared taxonomy covering the different stages of a credential’s lifecycle, from issuance and use to modification, recovery and retirement.

Rather than prescribing specific security controls or risk-scoring methods, the framework gives wallet providers, credential issuers and relying parties a common structure for identifying potential vulnerabilities and assessing their exposure. Discussion group chair John Fiske also publicly acknowledged Kim’s contribution alongside the other participants.

A central concern raised by Kim is that vulnerabilities frequently emerge when different components of an identity system interact.

Source link