Intel · 2026-04-07
Identity Verification Platform Consolidation
By J. W. Bouckaert
Consolidation in identity and security
Large security and identity vendors have spent the last few years buying capabilities they did not build. Buyers who run several identity vendors side by side now have to decide whether to keep separate point solutions or move more of the work to one provider.
This article lists the deals that shaped the period, looks at what changes for a team when identity checks come from fewer vendors, and sets out questions to ask any vendor that calls itself a platform.
Deals from 2023 to 2025
| Acquirer | Target | What the target does | Status |
|---|---|---|---|
| Thales | Imperva | Application and API security, data security | About $3.6B, closed December 2023 |
| Cisco | Splunk | Security monitoring and observability | About $28B, closed March 2024 |
| Mastercard | Recorded Future | Threat intelligence | $2.65B, closed December 2024 |
| Socure | Berbix | Document verification | Announced June 2023 |
| Socure | Effectiv | Risk decisioning and case management | $136M, announced October 2024 |
| Prove Identity | Portabl | Reusable identity credentials | Announced January 2025 |
Two kinds of deal appear in the table. Thales, Cisco and Mastercard bought large security businesses that sit next to identity: API protection, log analytics and threat intelligence. Socure and Prove bought smaller companies that add a step to their own verification flows, such as document checks or reusable credentials.
Product consolidation also happens inside a single vendor. Twilio stopped accepting new customers for the Authy API and directs new integrations to Twilio Verify, so teams that built on Authy now plan their work around Verify instead.
Running several identity vendors
A common enterprise stack uses one vendor for SIM-swap or carrier checks, another for document verification, a third for passkeys or MFA and a fourth for fraud scoring. Each product can work well on its own. The costs show up between them.
Correlation
A SIM swap reported by a carrier and a passkey re-registration on the same account a few minutes later are each unremarkable on their own. Together they are a strong account-takeover signal. When the two events come from different vendors, someone has to join them: usually a rules engine or SIEM query the customer writes and maintains.
Audit evidence
A SOC 2 or ISO 27001 auditor reviews the control environment as a whole. When one sign-in touches four vendors, the evidence for that sign-in sits in four logs with different formats and retention periods. Each vendor also needs its own security review and data processing agreement.
Integration work
Each vendor brings its own API key, request format, error model, webhook schema and uptime commitment. The engineering time to integrate and maintain them is separate from the license cost, and it grows with each vendor added.
Questions for a vendor that calls itself a platform
- API. Is there one base URL, one authentication scheme and one error model, or several products behind a shared documentation site?
- Correlation. Can a signal from one check change the outcome of another without code you write and run?
- Audit log. Is there one log for all identity events, and is it protected against alteration?
- Data processing agreement. Does one agreement cover every signal type and data category the vendor processes for you?
- Origin of each capability. Which parts were built in-house and which were acquired? For acquired parts, ask whether they run on the same data model and API today.
The same questions apply to PasskeyBridge.
PasskeyBridge's role
PasskeyBridge sells identity signals as a service (ITRaaS). It does not replace an identity and access management system. A tenant integrates one API with one API key. Carrier signals, verifiable credentials, passkey checks and AI agent delegation are features of the same service, written in-house rather than acquired.
Answers to the questions above, for PasskeyBridge:
- Carrier, credential and agent signals arrive in one signal schema, and playbooks act on them in the same service.
- Identity events go to one hash-chained audit log with signed checkpoints, readable by tenant administrators.
- One Data Processing Addendum, incorporated into the Terms of Service, covers the service.
- Identifiers such as phone numbers are stored only as keyed HMAC-SHA-256 digests under a server-held pepper.
PasskeyBridge is not a full identity stack. It does not verify identity documents or run liveness checks, and its carrier lookups depend on third-party providers such as Vonage, Twilio and Sinch. A buyer that needs document verification will still have a separate vendor for it.
Outlook
Large vendors are likely to keep buying smaller identity companies, and some standalone products will be retired or folded into broader suites, as Authy's API was. When you buy, check what happens to your integration if the vendor is acquired: notice periods for API retirement, data export, and whether your contract survives a change of control.
---
See the identity assurance platform overview or read the API documentation.