Passwordless Authentication (IDaaS) Vendor: Technology & Cryptography Due Diligence

The target is a profitable identity-as-a-service vendor. It replaces passwords and SMS one-time passcodes for banks and fintechs, processes millions of authentications a day, and has strong retention. Its defensibility rested on a proprietary cryptographic scheme marketed with advanced security properties. The investment committee needed to know whether those claims held up, because the cryptography was the asset being bought.

• Ran the six standard workstreams and activated a seventh, Cybersecurity Technology Validation. We use it for security vendors whose core technology is the investment thesis.
• Reviewed seven domain questionnaires and a 25-item cryptographic information request, and tested each claim family independently against published standards.
• Delivered a full report set: a TDD report, a cryptography deep-dive, a consolidated risk register, competitive benchmarking against open authentication standards, and an IC executive summary with base, bull and bear cases.

• The product works and the market has validated it. Anti-phishing and replay resistance are largely sound, and symmetric-crypto hygiene, channel binding and randomness are well implemented.
• Several headline claims went further than the implementation supports. Key-handling guarantees held at rest but not at the point of use, hardware binding depended on the device, and quantum-resistance applied to one layer only.
• The scheme's core security parameter had not been quantified, and the scheme had never been reviewed by an independent cryptographer.
• Enterprise-readiness gaps: single-region resilience, no SOC 2 or ISO 27001 certification, unverifiable quality gates, and key-person concentration.

• Verdict: High Risk, Conditional Invest. The company is investable on its actual merits, not on the claims as marketed.
• Structured the transaction around closeable conditions: three conditions precedent, 90-day post-close evidence requirements, an escrow or holdback tied to SOC 2 Type 1 and a first independent cryptographic review, specific IP and open-source reps & warranties, and key-person retention.
• Delivered a four-phase, 12-month remediation roadmap with its underwriting impact framed as a use-of-proceeds line or an entry-valuation adjustment.