We’re Tracking the Future of Security

Category: Access Control & Identity

Credentialing, biometrics, smart locks and identity verification technologies that control who can enter a facility.

  • Tencent Brings Palmprint Verification to Standard Smartphone Cameras

    Tencent Brings Palmprint Verification to Standard Smartphone Cameras

    Tencent has introduced Palm X, a palmprint-verification capability designed to work with standard RGB cameras in smartphones and computers. The service analyzes visible surface patterns rather than relying on dedicated infrared illumination or palm-vein sensors.

    Software expands where palm recognition can be deployed

    Tencent says Palm X can support one-to-one verification and one-to-many searches through mobile software development kits and backend APIs. Removing specialized capture hardware may reduce deployment friction for applications that already have a suitable camera, but performance still depends on image quality and controlled capture.

    Visible palmprints are different from subsurface vascular patterns. Integrators should not treat the two modalities as interchangeable or transfer accuracy claims between them. Camera resolution, hand position, illumination, motion and background can influence whether a usable sample is obtained.

    Operational assurance remains essential

    Organizations should test presentation-attack resistance, enrollment quality, duplicate handling and behavior across representative devices. A consumer camera introduces more variation than a fixed reader, so device compatibility and minimum capture requirements need explicit acceptance criteria.

    The launch broadens the options discussed in SectechMedia’s Access Control & Identity coverage. Deployment governance should define consent, template protection, retention, fallback authentication and investigation procedures. The absence of dedicated hardware can simplify rollout, but it does not remove the need to validate the complete identity workflow.

    Sources

  • Revolut Pilots Face-Biometric Payments on New Retail POS Platform

    Revolut Pilots Face-Biometric Payments on New Retail POS Platform

    Revolut is piloting a face-authenticated payment service called Pay with Smile alongside a new point-of-sale platform aimed at UK hospitality businesses. The initial deployment is being tested at Kiss the Hippo cafes, according to reporting on the launch.

    Enrollment connects identity with a payment method

    The service is intended to let a registered customer authorize an in-store transaction by presenting their face at checkout. A practical deployment must bind the biometric enrollment to the correct customer and payment account, then confirm liveness and transaction intent at the point of use.

    Biometric convenience does not remove the need for fallback and dispute handling. Merchants and payment providers need a clear process for failed matches, changed appearance, shared accounts and customers who do not want to use the biometric option. Enrollment consent and template protection are also central to the risk model.

    Retail performance must be measured in context

    Lighting, camera position, customer movement and queue pressure can affect capture quality. Pilot evidence should therefore cover false acceptance, false rejection, transaction time, manual overrides and accessibility rather than relying only on successful demonstrations.

    The launch brings payment authentication into the wider Access Control & Identity discussion. Organizations considering similar systems should separate biometric matching from authorization policy, protect reference data, define retention limits and retain enough transaction evidence to investigate a disputed payment without exposing unnecessary biometric information.

    Sources

  • EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    EU Sets Digital ID Rules for Cross-Border Health Data Exchange

    The European Union has adopted implementing rules for identity, authentication and interoperability in cross-border electronic health-data exchange. Commission Implementing Regulation (EU) 2026/2099 establishes technical and organizational requirements intended to support trusted access across national systems.

    Identity assurance becomes part of the exchange architecture

    Cross-border health services must determine who is requesting or providing data, which role the person holds and whether the relying system can trust the asserted identity. The regulation connects those checks with common interoperability and security requirements rather than treating authentication as an isolated login feature.

    The rules sit within the European Health Data Space framework and are designed to support consistent exchange while national identity and healthcare infrastructures remain different. Implementers must therefore map local credentials and professional roles into a shared trust model without weakening national safeguards.

    Deployment requires governance beyond technical connectivity

    Operators should document identity proofing, credential lifecycle, role assignment, consent and audit responsibilities across organizational boundaries. A successful connection does not by itself prove that the correct person received the correct level of access. Exception handling and revocation must work across the same chain.

    The regulation is relevant to broader Access Control & Identity programs because it demonstrates how identity assurance, authorization and interoperability meet in a regulated environment. Health-data exchange teams should test both normal and degraded workflows, preserve decision records and verify how trust changes when a credential or professional role expires.

    Sources

  • Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia Considers mGrađani Digital Identity for Online Age Verification

    Croatia is considering its mGrađani digital identity application as a tool for electronic age verification while European institutions develop new online child-protection rules. The government says the application already supports a privacy-preserving way to confirm that a user is over 18.

    Age proof without full identity disclosure

    The Croatian Ministry of Justice, Public Administration and Digital Transformation said more than 204,000 citizens use mGrađani. Its age-verification function is designed to provide an eligibility result rather than disclose a person’s full identity record to an online service. That distinction can reduce unnecessary data exposure when a service only needs proof of age.

    The proposal is being discussed as Croatia prepares its position on the emerging EU KIDS Act framework. The final European rules and the technical role of national identity applications are still developing, so the announcement should not be read as a completed mandatory deployment.

    Implementation questions remain

    Age-verification systems need clear legal purpose, data-minimization controls, accessible alternatives and testing against exclusion or circumvention. Operators also need assurance that relying services cannot silently expand the information requested beyond the age claim. SectechMedia follows related identity architecture in its access control and identity channel.

    Sources

  • ICE Plans Nationwide Intelligence Support Network for Biometric Targeting Operations

    ICE Plans Nationwide Intelligence Support Network for Biometric Targeting Operations

    U.S. Immigration and Customs Enforcement is preparing a contracting effort to expand intelligence research support across Enforcement and Removal Operations headquarters, field areas and national targeting centers. The proposed structure, described in federal procurement records, would place cleared analysts in locations that already use biometric and biographic information for identity resolution.

    A distributed analyst network

    The planning documents call for approximately 142 intelligence research specialists across headquarters, 24 field areas and three national support centers. The Law Enforcement Support Center, National Criminal Analysis and Targeting Center and Pacific Enforcement Response Center already combine law-enforcement, immigration and identity information to generate operational leads.

    The statement of work does not say that contractor analysts will operate a new facial-recognition or fingerprint platform. It describes all-source research, intelligence-gap analysis, network analysis and operational support within an existing enforcement architecture. Reporting should therefore distinguish the proposed analyst workforce from any separate biometric technology procurement.

    Governance and oversight

    The records describe work involving classified information, law-enforcement-sensitive data and personally identifiable information. Any deployment will require strict access controls, audit logging, human oversight, retention rules and review of how identity data supports consequential decisions. The procurement notice was posted on September 18 and remained a planning action rather than proof of a completed award. SectechMedia follows similar systems in its border security coverage.

    Sources

  • SIA and AMAG Launch Role-Based OSDP Training Program

    SIA and AMAG Launch Role-Based OSDP Training Program

    The Security Industry Association and AMAG Technology have announced a tiered training program for the Open Supervised Device Protocol. The curriculum is intended to give commercial teams, installers and operators different levels of instruction based on how they specify, deploy or maintain access-control communications.

    Training by operational role

    Sales and marketing participants will study OSDP fundamentals and how the protocol differs from older reader interfaces. Technical personnel will receive configuration and troubleshooting instruction through AMAG coursework combined with SIA’s OSDP Boot Camp. AMAG says the certified material is being incorporated into its core training curriculum.

    OSDP defines communication between access-control panels and peripheral devices such as readers. It supports bidirectional communication and secure-channel capabilities when correctly implemented. Training remains only one part of a secure deployment: device compatibility, key management, wiring, firmware and commissioning procedures still need to be verified at system level.

    Why implementation discipline matters

    Protocol support on a datasheet does not guarantee that every feature is enabled or interoperable. Integrators should test secure-channel operation, supervision, addressing and fault reporting across the exact panel and reader combination used on site. Documented commissioning and maintenance procedures help preserve those controls after handover. SectechMedia covers related design issues in its access control and identity channel.

    Sources

  • UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    UNCTAD Evaluation Highlights Digital Identity Training for Small Island States

    An independent evaluation published by the United Nations Conference on Trade and Development has assessed a three-year capacity-building program for small island developing states. The project used UNCTAD’s TrainForTrade model and covered digital identity for trade and development, legal aspects of e-commerce and digital-economy statistics.

    Training across dispersed jurisdictions

    The project ran from March 2022 through December 2025 and reached participants across Africa, the Caribbean and Asia-Pacific. According to the evaluation, 153 participants completed the digital-identity course, while the wider initiative reached 920 participants across 58 countries and territories. The assessment drew on document review, stakeholder interviews and a participant survey.

    Digital identity was treated as enabling infrastructure for secure digital trade and access to online services. The report also records practical constraints, including geography, resource limitations and remote data collection. Those limitations are relevant when translating training outcomes into national systems and policy.

    Implementation remains country-specific

    Capacity building does not by itself establish a trusted identity system. Governments still need legal authority, privacy safeguards, cybersecurity controls, inclusive enrollment and interoperable credentials suited to local conditions. The evaluation is useful as evidence about training delivery and institutional learning rather than as proof of a single technical architecture. SectechMedia follows related developments in its identity technology coverage.

    Sources

  • Face Recognition Research Exposes Limits of Image Quality Scores

    Face Recognition Research Exposes Limits of Image Quality Scores

    Recent research is challenging the assumption that a single image-quality score can reliably predict face-recognition performance. A Johns Hopkins University study examined low-resolution and degraded imagery, while current NIST evaluations compare quality estimators against the utility of images for automated matching.

    Quality and recognition utility are different

    Blur, occlusion, compression and low resolution can remove information from a face image. Newer recognition algorithms may still recover useful identity cues from some degraded samples, but a visually poor image is not automatically unusable and a visually clean image is not automatically useful for every matcher. The distinction matters when operators use quality thresholds to accept, reject or recapture images.

    NIST’s Face Recognition Technology Evaluation publishes results for face-image quality algorithms and links those scores to recognition error. The Johns Hopkins work focuses on recognition under severe degradation. Together, the findings support testing quality measures against the actual cameras, capture conditions and matching systems used in an operational deployment.

    Operational implications

    Security teams should avoid treating a vendor-neutral quality number as a universal pass-or-fail decision. Acceptance testing should include representative lighting, distance, pose and compression conditions, followed by matcher-specific performance checks. Human review and alternative identity evidence remain important where poor imagery or high-consequence decisions are involved. SectechMedia covers related system design in its access control and identity channel.

    Sources

  • Access Credential Revocation and Offboarding for Physical Security Systems

    Access Credential Revocation and Offboarding for Physical Security Systems

    Offboarding is complete only when a departing person’s physical and digital access paths have been identified, revoked and verified. A returned badge does not prove that mobile credentials, biometric enrollments, vehicle permissions, visitor-system accounts or remote administration rights have been removed. The process must follow the identity across every connected security system.

    Build an authoritative trigger

    Revocation should begin from a trusted personnel or contract event with an effective time and accountable owner. Human resources, procurement, facilities and security may hold different parts of the record, so the workflow needs one authoritative trigger and a method for urgent terminations. Role changes and extended leave also require review even when the person remains employed.

    The request should identify the person, organization, sponsor, credential types, sites and systems in scope. Avoid using names alone; duplicate names and formatting differences can lead to missed records. Preserve identifiers that allow operators to find the same identity in the access-control system, visitor platform and mobile-credential service.

    Revoke the credential and the entitlement

    Disable active badges and mobile credentials, but also remove the access levels, groups and schedules that granted permission. Otherwise a replacement credential may inherit rights that should have ended. Biometric templates and identity documents should be handled according to retention and legal requirements rather than left indefinitely in an active population.

    Collect physical badges where practical and record those that were not returned. Vehicle tags, keys, tokens and temporary passes need their own disposition. Contractors may have access through a shared employer relationship, so terminating one assignment should not accidentally remove or preserve access for unrelated personnel.

    Verify across integrations and offline devices

    Integrated systems may not update simultaneously. Confirm that revocation reached downstream controllers, wireless locks, elevators, parking systems and third-party services. Offline locks and cached mobile credentials deserve particular attention because a central status change may not take effect until synchronization.

    Test high-risk cases by reviewing the credential status and recent transactions. Do not create a real unauthorized entry attempt unless the procedure is controlled. The verification record should show who performed each action, when it completed and which exceptions remain open.

    Measure timeliness and completeness

    Track the interval from the effective termination time to confirmed revocation. Separate routine delays from urgent failures, and investigate credentials that remain active beyond policy. Periodic reconciliation between personnel records and active access identities can identify orphaned accounts, expired contractors and duplicated credentials.

    Access offboarding is a lifecycle control within Access Control & Identity, not a one-time badge task. Clear ownership, complete inventories and evidence-based closure reduce the window in which former access can be misused.

    Include service identities and scheduled accounts assigned to the departing person. Shared administrative credentials should be rotated through a controlled process when exposure cannot be ruled out, while audit evidence is preserved.

    Reference sources

  • YouTube Extends Likeness Detection to Voice-Based AI Impersonation

    YouTube Extends Likeness Detection to Voice-Based AI Impersonation

    YouTube is expanding its likeness-detection program to include voice-based impersonation, adding another signal for identifying synthetic content that appears to imitate eligible creators. The platform previously introduced tools centered on visual likeness and is now extending the program as generated audio becomes easier to produce and distribute.

    Voice becomes part of the review workflow

    The system is intended to surface videos that may contain an AI-generated version of a creator’s voice. Detection is not the same as an automatic removal decision. A flagged result still needs review because parody, commentary, licensed use and coincidental similarity can affect the appropriate response.

    YouTube’s existing privacy complaint process considers whether content is altered or synthetic, whether it is realistic and whether the person can be uniquely identified. Adding voice broadens the evidence available to creators, but the platform still needs enrollment controls, secure reference data and an appeals path to reduce false claims.

    Detection requires governance as well as matching

    Voice-likeness systems operate in difficult conditions: compression, background music, short clips, accents and intentional transformation can change performance. Attackers can also combine genuine and generated segments. Effective operation therefore requires confidence thresholds, human review and records showing why a decision was made.

    The development connects identity protection with Cyber-Physical Security governance. Organizations using similar tools should define who can enroll a reference voice, how consent is verified, how long biometric-derived templates are retained and how disputed matches are investigated.

    Sources