The fingerprint passed.
The person didn't.
Pillar 13 of 25 · 8 min read · Biometric authentication is not the problem. The assumption that it can stand alone — without certified hardware — is.
See how this applies to your environment
Book a 30-minute briefing with Ciptor. We'll walk through what live-fire validation typically uncovers in environments like yours.
The Assumption
Biometric authentication is inherently more secure than passwords because it is tied to the physical person.
The Reality
A biometric is only as secure as the system that processes it. If matching happens in software, templates are stored centrally, or the sensor lacks liveness detection — the permanence of a fingerprint becomes a liability, not an asset.
The Blueprint
Biometric matching must happen inside certified hardware. The private key must never leave the secure element. The biometric unlocks the hardware; the hardware is the authenticator.
Why permanence changes the stakes
A compromised password is an inconvenience. A reset solves it in minutes. A compromised biometric template is a different category of problem. You cannot change your fingerprints. You cannot issue a new iris. If a biometric template is leaked from a centrally-stored database, the affected person's identity credential is permanently degraded — for every system that uses that biometric, for life.
This is not a theoretical concern. Large-scale biometric database breaches have affected tens of millions of records. The attackers did not need to be at the same location as the target. They only needed network access to where the templates were stored.
Three spoofing realities CISOs rarely discuss
Most biometric security discussions at board level centre on fingerprint lifting from physical surfaces. That threat is real but it is also the least sophisticated — and arguably the easiest to defend against. The three threats that matter at enterprise scale are architectural, not physical.
What hardware root of trust actually fixes
The answer to all three threats is structurally the same: the biometric match must happen inside tamper-resistant hardware, and the private key must never leave that hardware.
When matching is performed on-device inside a certified secure element, a stolen template from a database is useless — there is no external system for an attacker to fool. When the private key is bound to the hardware and cannot be extracted, software-layer spoofing produces no usable credential. When a certified chip resists physical analysis, presentation attacks face a tamper-resistant barrier at the most fundamental layer.
This architecture separates security theatre from genuine phishing-resistant authentication. The biometric is a convenience factor for unlocking the hardware key. The hardware key is the authenticator.
The hardware that gets this right
NIS2 Article 21 — What biometric authentication controls must demonstrate
Under NIS2 Article 21(2)(i), organisations must implement multi-factor authentication or continuous authentication solutions, with documented evidence of the controls in place. Regulators are increasingly asking not just whether biometrics are used, but where matching occurs, what happens to templates, and whether the underlying hardware carries independent certification. On-device matching inside a CC EAL6+ secure element with ANSSI Security Visa or FIPS 140-3 Level 3 provides the evidence trail regulators are looking for.
The framing question for your next procurement decision.
When evaluating any biometric authentication system, the question is not whether the product passed a certification. The question is: where does the biometric match happen?
If the answer is "in software on the host device" or "on a server" or "we store templates centrally," the permanence of biometric data is working against you, not for you.
If the answer is "on a CC EAL6+ certified secure element, inside the hardware token, and the template never leaves the key" — that is the architecture that eliminates all three threat categories simultaneously.
