The Identity Assurance Gap in Zero Trust
Zero trust architecture has transformed how organizations secure their networks, but it has largely failed to solve one fundamental problem: verifying that the person behind a request is actually who they claim to be. Most zero trust onboarding models validate devices and credentials, not people. That gap is now being exploited at scale by criminal operations.
According to the Cloudflare 2026 Threat Report, these aren't just individual bad actors anymore. Organized operations—often linked to nation-states, including North Korea—are running "laptop farms": warehouses filled with corporate-issued devices, remotely accessed by workers using stolen identities to infiltrate companies, steal intellectual property, and siphon off revenue.
Generative AI has made these schemes far more effective. Attackers use AI to pass job interviews and deepfake tools to fabricate government IDs that withstand casual scrutiny. Traditional background checks and standard identity provider (IdP) configurations are no longer sufficient defenses.
To address this, Cloudflare is partnering with Nametag, a workforce identity verification company, to integrate identity-verified onboarding and continuous identity assurance into Cloudflare One, its SASE platform.
How Insider Threats Get In
The "remote IT worker" scheme exploits the gap between hiring and onboarding. Attackers use stolen or fabricated identities to land legitimate remote positions. When the company ships a laptop, it goes to a "mule" address—typically a domestic laptop farm in the country where the employee claims to live. The device gets racked and connected to a keyboard, video, and mouse (KVM) switch, allowing the remote actor to log in via VPN or remote desktop as what appears to be a legitimate employee.
The danger is that these attacks slip past traditional security controls. The credentials are valid, the device is corporate-issued, and the traffic pattern looks normal. Standard zero trust network access (ZTNA) policies often treat this activity as safe, even though data loss prevention (DLP) and user entity behavior analytics (UEBA) tools only spot the problem after the attacker is already inside the perimeter with access to sensitive repositories.
Verifying Identity Before Access
Cloudflare Access already acts as the aggregation layer for security policies, checking device posture, location, and group membership when users request access to applications or infrastructure. The partnership with Nametag adds a new dimension: workforce identity verification.
Nametag is integrated via OpenID Connect (OIDC). It can be configured as an IdP within Cloudflare Access, or chained as an external evaluation factor alongside a primary identity provider such as Okta or Microsoft Entra ID.
Example of the Cloudflare Access login page prompting for a user to authenticate using Nametag.
A typical high-security onboarding flow works like this:
- Trigger: A new user attempts to access their onboarding portal, which is protected by Cloudflare Access.
- Challenge: Cloudflare directs the user to Nametag for authentication via OIDC, rather than presenting a standard username and password prompt.
- Verification: The user enters their work email, takes a selfie with their phone, and scans a government-issued photo ID.
- Attestation: Nametag's Deepfake Defense™ engine uses cryptography, biometrics, and AI to confirm the user is a real person and the right person. It's specifically designed to prevent deepfake IDs and selfies in injection or presentation attacks, such as holding a printed photo up to a camera.
- Enforcement: On successful verification, Nametag sends an ID token to Cloudflare, which grants or denies access based on the user's identity and the configured Access policies.
This all happens before the employee can reach email, code repositories, or any other internal resource.
Verifying identity with Nametag takes under 30 seconds, and no biometric data is stored after the interaction.
Layered Defense and Continuous Verification
Nametag complements Cloudflare's existing insider threat protections, which already include API-driven DLP for scanning data exfiltration, Remote Browser Isolation (RBI) to reduce browsing risk, and a Cloud Access Security Broker (CASB) along with a shadow IT report to identify unsanctioned tools and misconfigurations.
Stopping bad actors at the door isn't enough, though. Credentials can be sold, and legitimate employees can be compromised after they've been onboarded. Cloudflare Access now incorporates user risk scores, allowing teams to build context-aware policies that revoke access when a user's risk level spikes from low to high.
Future capabilities will support step-up verification mid-session, based on signals like user risk score. Instead of a disruptive "big red button" shutdown for a user who may legitimately need to access a production billing system from an unusual location, the system will challenge the user to re-verify with Nametag or strong MFA. A session hijacker or bot won't be able to pass those checks.
Planned expansion of this capability extends to self-service IT workflows, especially password resets and MFA device registration. These portals are prime targets for social engineering, as demonstrated by the MGM Resorts help desk attacks. Placing Nametag behind Cloudflare Access for these portals eliminates the possibility of an attacker tricking a support agent into resetting a password.
A Practical Path Forward
The "remote IT worker" threat is an active, documented campaign, not a hypothetical scenario. Rolling out protection doesn't require any reduction in existing infrastructure; identity-verified onboarding can be layered on top of current IdP and application setups. Cloudflare One is free for up to 50 users, which is enough to pilot identity-verified onboarding or protect high-risk internal portals.
AI can now fake a face and a voice convincingly. Cryptographic proof of identity is the only reliable way to verify a workforce in that environment—trusting nothing, not even the face on the screen, without verification.
