Companies Face Pressure to Prove Who Is Really Behind an Account

Regula, a company that builds identity verification tools, released its 2027 outlook on November 2, 2026. Its central warning: attackers do not need to beat every safeguard. They need one weak route. Regula says businesses will face more pressure to prove who is behind an account, and to show how they decided.

What changed

The outlook names 10 changes for businesses to prepare for. Regula says they point to one idea. Identity should be checked throughout the customer journey, not just once at sign-up. Five of the forecasts are highlighted in the announcement. The full set is in a report on the Regula Blog.

Where attackers may look

Instead of fighting a strong document check at sign-up, attackers could look for weaker recovery routes, exceptions, or steps that can be skipped. Regula also expects AI to help attackers study how identity systems handle failed checks, retries and recovery. It expects buyers to ask for proof that every permitted route enforces the right controls.

The record problem

Regula's research found that 82% of surveyed organizations had been asked to explain an identity-related decision to outsiders. Only 50% said they could fully reconstruct a verification decision. A record that just says "verified" explains little. Investigators want to know which checks ran, which rules applied and whether an employee overrode a result.

AI agents and permission

Regula also looks at AI agents that act for customers. Say a customer lets an agent book a flight for up to $1,000. If the fare rises to $1,200, the original permission no longer covers it, and fresh approval is needed. Regula predicts demand for permission records that other services can check for themselves.

What to do

• Test account recovery and customer support steps, not only sign-up.
• Keep records of which checks ran and why someone was approved.
• Decide which actions, like losing a device, call for fresh proof.
• Avoid making every returning customer repeat full sign-up.

Regula's report ends with five questions to ask an identity verification provider. They cover workflow security, reverification, auditability, data control and the ability to adapt to new requirements. Note that these are predictions from a company that sells identity tools.