Innovatrics wins high-level certification for injection attack detection

Innovatrics said its Enterprise Identity Verification solution has earned the highest CEN/TS 18099 level for injection attack detection after independent testing by CLR Labs. The result gives banks, fintechs and EU-qualified trust providers evidence that the system can resist advanced biometric capture attacks without adding too much friction for legitimate users.

Why it matters: - The certification gives regulated organizations independent evidence that Innovatrics' remote identity verification technology can resist advanced injection attacks. - The result is especially relevant for qualified trust service providers, banks, fintech companies and other businesses that depend on high-assurance onboarding in Europe. - The evaluation is tied to CEN/TS 18099, the benchmark referenced by ETSI TS 119 461 for Injection Attack Detection in applicable remote identity proofing processes.

What happened: - Innovatrics announced that the injection attack detection capability in its Enterprise Identity Verification solution achieved High-level certification under CEN/TS 18099. - CLR Labs performed the independent evaluation under the CLR Cert biometric Injection Attack Detection certification programme. - The announcement was made Nov. 3, 2026, in Bratislava, Slovakia.

The details: - High is the highest evaluation level defined by CEN/TS 18099. - The tested configuration showed no successful injection attacks. - The evaluation found that 1.3% of bona fide capture attempts were incorrectly classified as attacks. - The technology checks the capture environment for signs of manipulation, including virtual or emulated cameras and altered image data. - Evidence collected during capture is protected as it reaches the server, where additional controls look for substituted or replayed biometric data. - The injection attack detection approach is designed to work across multiple capture modalities. - The certification was achieved for face biometrics. - Innovatrics said the same detection approach can also protect identity documents and biometric modalities such as palm and fingerprints.

Between the lines: - The certification matters because security teams need controls that stop spoofing attempts without creating extra friction for real users. - The result also signals that independent testing is becoming a key buying signal for remote onboarding and digital trust products. - Jan Lunter, founder and CEO of Innovatrics, said independent testing gives partners and their customers evidence that the company's capture controls hold up against attack and that the company will keep testing as attacks change.

What's next: - Innovatrics said it will continue testing as attack methods evolve. - The company plans to extend the same injection attack detection approach across more identity capture use cases and modalities. - Qualified trust service providers and other regulated organizations can now use the certification as one more input when assessing remote identity verification technology.

The bottom line: - Innovatrics now has independent, high-level evidence that its identity verification system can withstand advanced injection attacks in the tested configuration while keeping false alarms relatively low.