World ID makes case for enterprise-scale authentication, but some aren’t buying it

Despite being banned or under regulatory enforcement in jurisdictions including Spain, Germany, Brazil, Hong Kong, Portugal, Kenya and South Korea, iris biometrics firm World continues to grow its business around proof of personhood, which it frames as indispensable in a world of deepfakes and AI agents.

Its latest announcement sees the firm, known for its Orb iris scanning balls and for being co-founded by OpenAI CEO Sam Altman, partnering to offer “proof of human” for Zoom, DocuSign, Tinder, Shopify, Okta and VanEck.

“Participants who enroll will get a badge on their video tile. Think of it as a blue checkmark for your face, issued after you stare into a device the company calls The Orb,” writes Matt Moynahan, CEO of GetReal Security, in a blog.

While Moynahan acknowledges the problem of authenticating real people in a digital world, he has big questions about World’s system, which he says “deserves a hard look from every CISO, CIO, and General Counsel whose organization may be asked to adopt it.”

“A crypto-native, consumer-focused, hardware-dependent, single-modality, point-in-time verification system is not a neutral technical choice when the problem you are trying to solve is enterprise security.” World, Moynahan says “was not built for the enterprise. It was built to issue digital IDs to consumers in exchange for cryptocurrency.”

“Enterprises and governments do not have the same threat model as a 19-year-old in Nairobi signing up for $40 in tokens. And they should not be authenticating their boardrooms on a network built on that foundation.”

World ID 4.0 up to the task of enterprise authentication: World

Nonsense, says World, in its announcement on the Docusign deal. The company believes the recent upgrade to the protocol behind World ID qualifies it to serve as a valid enterprise authentication layer.

“The new World ID makes human continuity practical at enterprise scale. Multi-key support and an account-based architecture mean a World ID is no longer tied to a single device or application, giving security and IT teams the interoperability and vendor independence they expect from production infrastructure. Key rotation allows organizations to respond to compromise without losing access. Recovery mechanisms ensure continuity in worst-case scenarios. And session management allows relying parties to confirm that the same verified human is present across an ongoing interaction, the foundation of human continuity in practice.”

For Zoom, World ID will help verify participants on video calls and guard against deepfake impersonation. “Rather than just trying to detect whether a video feed is fake, World ID Deep Face lets you confirm that the person you’re speaking with is a real human, not a deepfake,” it says. “The other person can easily prove they’re not a deepfake in a few steps using face authentication, shifting from detection to real-time proof of presence.”

“Proof of human is becoming a foundational primitive in the enterprise, operating alongside zero trust, endpoint detection, and threat intelligence as part of a modern security architecture.”

What is World, exactly?

World’s recent pivots reflect the difficulty the company has had in getting people to freely stare into the Orb to trade iris biometrics for a cryptographic proof. Speaking at a recent live event, Tiago Sada, CPO of World collaborator Tools for Humanity said 18 million users have scanned their iris biometrics and used their credentials 150 million times.

The company’s recent live event saw it positioning itself as an identity verification provider for the world of agentic AI, with new tools covering selfie biometric authentication, deepfake protection and bot-resistant governance. World is also launching a “Concert Kit” tool designed to help artists cut down on bot-driven ticket scalping.

Article Topics

biometric authentication  |  biometrics  |  deepfakes  |  digital ID  |  enterprise  |  GetReal Security  |  proof of personhood  |  World  |  World ID