Intel · 2026-07-23

The Identity Stack Bifurcation: Consumer Wallets vs Enterprise Attestation Layers

By J. W. Bouckaert

Two categories, one confused analyst deck

Read almost any 2026 identity market map and you will find Apple, Google, the European Commission, Okta, Ping, a carrier-signals startup, a behavioral biometrics vendor, and an agentic-identity newcomer arranged as if they compete. They do not. They occupy two different halves of the stack, they solve two different problems, and treating them as one category has already caused enterprise buyers to procure the wrong product at least once per quarter.

The identity market is bifurcating along a clean seam: credential storage and presentation on the consumer side, and session and signal attestation on the enterprise side. The consumer half asks "who does this person claim to be, and can they prove it with a document they carry?". The enterprise half asks "is this session, right now, safe to trust, and does the entity behind it behave like the account owner?". Both halves are real products with real revenue. Neither is a substitute for the other.

The split is more than taxonomy: it is a procurement warning, an architecture argument, and, for anyone building in the space, a positioning decision that will define whether the company is worth anything in 2028.

The seam

The clearest way to see the split is to ask: what does the vendor's primary output prove, and to whom is it addressed?

A consumer wallet is held by the subject and speaks for the subject. An enterprise attestation layer is held by the application and speaks about the session. The direction of trust is opposite. The lifecycle of the artifact is opposite. The freshness requirements are opposite. And most consequentially, the buyer is opposite: a wallet is procured by the government or platform that issues credentials; an attestation layer is procured by the enterprise that consumes signals.

The consumer half: Wallets, documents, presentations

The consumer-wallet half of the market has three functional layers:

1. Issuance. A trusted party (a state DMV, a national identity provider, a university, an employer) mints a credential and delivers it to a wallet controlled by the subject. In Europe this is governed by eIDAS 2.0 and the EUDI Wallet Architecture Reference Framework. In the United States it is fragmented: state DMVs, TSA, and a growing set of employer issuers, largely under ISO/IEC 18013-5 for mobile driving licenses.
2. Storage. The credential lives on a device—Apple Wallet with its Secure Enclave, Google Wallet with StrongBox, an EUDI reference wallet, or a third-party wallet that meets the local certification bar.
3. Presentation. The subject presents the credential, selectively disclosing attributes, over BLE, NFC, QR, or OpenID4VP, depending on whether the interaction is in person or online. Formats include ISO 18013-5 mDoc, W3C VC 2.0, and SD-JWT-VC.

This half of the market is dominated by platforms and governments. Apple and Google set the terms of what a wallet can do on their operating systems. The European Commission sets the terms of what a wallet must do to be recognized under eIDAS 2.0. State DMVs and national identity providers issue the credentials. Independent wallet vendors exist, but they operate inside a shrinking envelope, because the platforms are increasingly bundling wallet functionality into the OS itself.

The consumer wallet answers a specific question well: "can this human present a signed statement, from an issuer we trust, about an attribute of theirs, right now, without exposing more than we asked for?" For border control, age verification, professional licensing, and increasingly employment verification in the EU, this is the correct primitive. It fails for a different set of questions—the ones the enterprise half exists to answer.

The enterprise half: Attestation, signals, sessions

The enterprise-attestation half of the market has a different structure. Its primary output is a signal about the session that just arrived rather than a credential the user carries.

The signals fall into families:

• Carrier and network signals. Is this SIM the one that was on record last month, or was a SIM swap executed at the carrier three hours ago? Was the number recently ported? Has the IMSI shifted? These are attested by carrier APIs, aggregated through providers like the GSMA Open Gateway, and delivered through edge-first verification inside the request that needs them.
• Device and posture signals. Is the device attesting a valid platform key (WebAuthn attestation, Play Integrity, App Attest)? Is DPoP bound to a key the client actually holds?
• Behavioral signals. Does the typing cadence, mouse motion, or interaction rhythm match the account owner's historical distribution, and if not, is this a benign context switch or an agentic substitution?
• Agentic signals. When an AI agent acts on a user's behalf, does it hold a valid delegation with a bounded scope, and is the model behind it the one that was authorized (delegating identity to AI agents)?

None of these lives in a wallet. None of them is presented by the user. They are collected by the attestation layer during the session, evaluated against policy, and emitted as a trust decision back to the application. The primitive is a signed, time-bound, verifier-addressed attestation, not a signed, subject-issued credential.

Every attestation is zero-PII by construction: the layer's job is to answer "trust or not, and why" in a form the application can audit without ingesting new personal data.

Cost of missing the distinction

Every quarter, a mid-market enterprise procures a "digital wallet" solution expecting it to solve account takeover, and discovers eighteen months later that the wallet did nothing to stop the wave of SIM-swap-driven fraud that took out its help desk. Every quarter, a different enterprise procures a "behavioral biometrics" or "device intelligence" product hoping it will handle age-verification compliance and discovers it cannot present a credential that satisfies a regulator's issuance requirement.

Both procurements failed for the same reason: the buyer treated the market as one category and picked the wrong half.

The seam matters practically because:

• Freshness models differ. Consumer wallet credentials are valid for months or years, refreshed by the issuer. Enterprise attestations are valid for seconds or minutes and re-attested per request. An attestation layer that "expires yearly" is not an attestation layer; a wallet credential that "expires in 60 seconds" is unusable in a bar or an airport.
• Trust anchors differ. A wallet decision anchors to an issuer PKI or DID. An attestation decision anchors to the attestation provider's signing key and, transitively, to the carrier, device platform, or behavioral vendor that produced the underlying signal. Neither anchor set collapses cleanly into the other.
• Failure modes differ. A wallet fails when an issuer's key is compromised, when a device is lost, or when the presentation protocol version-mismatches. An attestation layer fails when a carrier API is degraded, when a device platform pushes an attestation-format change, or when a behavioral model drifts. Incident-response playbooks are not portable across the seam.
• Regulatory posture differs. Wallets are increasingly regulated at the credential level: what a wallet must do to be recognized, what it must disclose, how it must handle selective disclosure. Attestation layers are regulated at the risk-management level: DORA Article 28, NIST 800-63, PSD3 SCA, and enterprise SOC 2 procurement audits. A single procurement rarely satisfies both.

The vendor map

Below is our own map of the 2026 vendors, with the seam drawn where we see it. It is not exhaustive—no map is—but it makes the split visible.

Two clarifications this table forces:

Identity proofing is not attestation. Onfido, Persona, Sumsub verify a document at onboarding. That is a one-time, high-friction event. Once the account exists, the question "is this session the account owner?" is a different product. Proofing vendors are increasingly attaching per-session risk scoring, but their center of gravity remains issuance-adjacent.

IAM is not attestation either. Okta, Ping, and Entra manage identities and enforce policies. They consume attestations; they generally do not produce them. When Okta says "step-up MFA", the signal that made them decide to step up came from somewhere—posture, behavior, carrier, geo, threat feed—and increasingly that somewhere is a specialized attestation provider.

Analyst framing

Three failure modes recur in analyst framing.

Failure 1: Treating "digital identity" as one category. The most common. It buckets wallets, IAM, proofing, and attestation into a single Magic Quadrant, then ranks vendors as if they compete. They do not compete; they interoperate. A ranking that puts Apple Wallet next to Ping Identity is describing something other than the market.

Failure 2: Assuming wallets absorb attestation. A tempting narrative: "the wallet will hold everything—credentials, session state, behavioral history, device posture." It will not. Wallets are optimized for user-side selective disclosure. Session attestation requires access to network state, device platform state, and behavioral state that the wallet does not hold and, for privacy reasons, should not hold. The consumer wallet is not the correct trust boundary for enterprise session decisions.

Failure 3: Assuming attestation absorbs wallets. A different but equally tempting narrative: "attestation layers will just federate all the signals and issue credentials themselves." Also wrong. Attestation layers are not government issuers, they are not licensed to mint mobile driving licenses, and their trust anchors are structurally different from state PKIs. An attestation layer that tries to become an issuer becomes a worse issuer than the state and a worse attestation layer than a focused specialist.

The correct model is that the two halves are complementary. A wallet asserts what someone is authorized to be. An attestation layer asserts what a session is safe to trust right now. The application makes the decision on both.

A sequence rather than a substitution

For a relying party building against 2026 reality, the two halves compose in a specific order.

                  ┌─────────────────────────┐
                  │  Consumer Wallet Path   │
                  │  (occasional, high-     │
                  │   assurance, credential-│
                  │   backed identity)      │
                  └──────────┬──────────────┘
                             │
              onboarding, KYC, high-value action
                             │
                             ▼
   ┌────────────────────────────────────────────────┐
   │  Enterprise Attestation Layer (this session)   │
   │  Carrier freshness · Device posture · Behavior │
   │  · Agentic delegation · Policy · Audit         │
   └────────────────────────────────────────────────┘
                             │
                     signed decision + audit
                             │
                             ▼
                    Application authorizes

The wallet is presented rarely—at onboarding, at KYC uplift, at a bank branch, at a border, at a bar, at an employer onboarding portal. The attestation layer runs every session, silently, inside the latency budget of a real login or transaction. One is heavy and rare; the other is light and continuous. Neither replaces the other.

For founders: Positioning to survive the consolidation

If you are building on the consumer-wallet side, the platform is your competitor and your distribution channel simultaneously. Apple and Google will absorb the generic wallet function into the OS. Survival for independent consumer wallets in the medium term requires either regulatory specialization (EUDI compliance, sector-specific credentials) or a distribution surface the platforms do not own (browser extensions, cross-device wallets for people who split between ecosystems).

If you are building on the enterprise-attestation side, the risks are different. Your competitors are not Apple and Google—they will not build carrier-signal or behavioral-analytics attestation, because their business models resist collecting the network and behavioral data at scale. Your competitors are IAM incumbents attempting to bolt on attestation without a source of signal, aggregators trying to be a bit of everything, and the temptation to drift into orchestration (which is a lower-margin business than attestation).

The clean positioning is: first-party signal sources, deep specialization in a signal family, per-request freshness budgets, zero-PII output, and honest audit trails. Everything else is either a platform product or a feature every vendor is expected to ship.

For the ITRaaS layer we operate, this positioning is the boundary we defend rather than an aspiration: we do not issue credentials, we do not run a wallet, we do not want to be a directory. We produce attested trust signals, in-request, addressed to the application, with the audit trail preserved for the compliance function.

A checklist for enterprise buyers

A short checklist that maps to the seam.

• Procure a wallet posture for regulated flows—KYC uplift, age gating, employment eligibility, and, in Europe, anything under eIDAS 2.0. Choose issuers you trust and be indifferent about the wallet brand your users hold, as long as it validates.
• Procure an attestation layer for the session decisions that happen after login. Ask which signal families are first-party, which are federated, and what the freshness budget is per signal. If a vendor cannot answer "how old is a carrier signal in your worst-case latency envelope", they are an aggregator.
• Refuse the false consolidation. No single product covers both halves well. A "unified identity platform" that claims to do wallet, attestation, IAM, and proofing is offering a bundling discount. The seam is real; buying past it is buying weakness.
• Preserve the audit granularity. Every access decision should record which half of the stack produced which fact. If a regulator or an incident-responder asks "what did we know, and how did we know it?" six months later, the answer must distinguish "the subject presented a signed mDL from the state" from "the attestation layer said the session's carrier tenure was intact." Collapsing the two loses the story.

Outlook

Instead of converging into a single product, the identity market is bifurcating into two mature, adjacent, interoperable categories with different buyers, different regulators, different failure modes, and different unit economics. The next five years will see both halves harden.

The consumer wallet will settle into three or four dominant platforms (Apple, Google, EUDI, and one or two national wallets outside Europe), a long tail of specialty issuers, and a shrinking set of independent wallet vendors. The enterprise attestation layer will specialize further—by signal family, by latency budget, by regulatory framework—and the aggregators trying to hold the middle will get squeezed by both the first-party signal producers below them and the IAM incumbents above.

For anyone still holding a market map with everything in one box: throw it away, redraw the seam, and rewrite the procurement policy. The strategy work is downstream of the taxonomy work, and the taxonomy has already changed.

Every signal verified. Inside the request that asked. On the enterprise side of the seam, where it belongs.

Read the mDL and W3C VC 2.0 bridge → See how ITRaaS attests carrier freshness → Zero-PII attestation architecture → Get started with PasskeyBridge →

Start free · Test the API