Accredited testing lab options grow as IAD providers seek edge in burgeoning market

Biometrics providers have responded to the surge of fraud attacks bypassing liveness checks altogether with a flood of injection attack detection (IAD) offerings, leaving businesses with the challenging task of separating those that work the best from the rest. Fortunately, the number of independent testing laboratories qualified to help with standards-based assessments is also increasing.

Among the latest biometrics developers to confirm the performance of their IAD with a lab evaluation is Aware.

And KPMG Switzerland, which operates the Software Test Center STS 0789, located in Zurich, has been accredited to carry out tests in line with European IAD standard CEN/TS 18099. The European standard is also the foundational document for an ISO/IEC standard in development.

While waiting for the ISO standard, a growing number of providers are opting for an evaluation based on CEN/TS 18099, despite NVLAP considering the standard out of its scope. Mitek Senior Manager, Product Management Becky Kiichle-Gross told the audience of a Biometric Update webinar earlier this year that because the “standards aren’t quite there yet,” some biometric providers use their own red teams to conduct internal testing.

The “2026 Injection Attack Detection Market Report & Buyer’s Guide” from Biometric Update and Goode Intelligence delves into the growing demand for independent IAD testing, with profiles of both the relevant standards and labs that test against them. Biometric Update’s report on “The Deepfake Fraud Detection Market 2026: Securing Identity in the AI Era” places IAD within the context of the overall AI fraud defense stack.

Zero errors for Aware

Aware passed a biometric IAD evaluation by BixeLab in May after successfully blocking all bypass attempts over 600 injection attacks. The company also recorded no false positives across 300 bona fide transactions.

“Comprehensive testing of injection attack detection systems requires more than a narrow technical check; it requires realistic attack methods, diverse test inputs, and rigorous assessment under controlled conditions,” said Ted Dunstone, CEO of BixeLab, at the time of the announcement. “Within the scope of this evaluation, Aware demonstrated strong performance against the representative injection attack scenarios tested, in an evaluation conducted in close alignment with CEN/TS 18099.”

Aware CEO Ajay Amlani noted that injection attacks have emerged among the most critical threats facing biometric systems.

“This independent evaluation by BixeLab demonstrates the strength of our solution in detecting and preventing these advanced attacks,” the CEO said. “We remain committed to continuous innovation and rigorous third-party validation to ensure our customers can trust their biometric systems in the face of evolving threats.”

Aware joins Unissey, Keyless, iProov, FaceTec, Emirates Face Recognition, Legitimuz, Oz Forensics and Advance.AI as biometrics providers to have passed independent IAD evaluations.

KPMG Switzerland joins IAD testing ranks

KPMG Switzerland’s biometrics testing lab, known as Software Testing Service (STS) 0789, is certified against the ISO/IEC 17025 standard for biometric testing labs by the Swiss Accreditation Service (SAS). The company began offering IAD testing in 2020, even before the European standard was complete. It has been testing biometric software since 2024 and PAD since last year.

STS 0789’s accreditation expanded to cover biometric injection attack detection in line with CEN/TS 18099 just weeks ago.

So far, the lab has found demand primarily comes from technology providers, KPMG Director and Head of Certification & Attestation Reto P. Grubenmann tells Biometric Update in an email. Interest in biometrics testing from enterprise buyers is growing as well.

The company expects the role of independent testing in biometrics procurement to continue rising in importance over the next few years, particularly in highly regulated sectors like financial services. The requirements under eIDAS 2.0 for identity-proofing services using biometrics to undergo regular conformity assessments, plus the damage deepfakes are doing to trust, are strengthening the role of independent testing in the digital identity ecosystem, Grubenmann says.

With its latest accreditation, KPMG’s STS joins BixeLab, Ingenium, CLR Labs, ACCS and iBeta, which launched IAD testing based on the European standard earlier this year.

The fraud threat posed by injection attacks has handily beaten the global standard to readiness, but organizations do not have to rely on marketing claims. The accumulating options for accredited independent test labs and successful assessments of IAD software are already empowering businesses to select technologies that work based on evidence.

Article Topics

AI fraud  |  Aware  |  biometric testing  |  biometrics  |  BixeLab  |  CEN/TS 18099  |  IAD certification  |  injection attack detection  |  KPMG  |  Software Test Center STS