The scanner is not the threat. The database is.
A client cannot change their face, their voice, or their DNA. But most of the biometric risk they carry has nothing to do with the accuracy of any scanner. It has to do with where the data pools, who can buy it, and which traits a person leaves behind in the world without consent. This hub sorts seventy-seven identifiers into the handful that actually threaten a client, and separates the danger from the noise.
Nine findings, before the detail.
The standing assessment synthesizes eleven briefs. These are the findings that survive compression.
The scanner is almost never the threat. The database is.
Fingerprint, iris, face, palm, and DNA are dangerous less because they are accurate than because they pool into centralized databases an adversary can breach or query.
Accuracy and danger are different axes
The most accurate biometrics in existence, finger and palm vein and retina, are among the safest for a client, because the trait is internal and cannot be captured covertly.
Low accuracy does not mean low danger
Voice verification grew less reliable as cloning matured, yet more dangerous, because the gates that trust it still stand.
What you cannot defend is a short list
Of seventy-seven identifiers, roughly two dozen are shed involuntarily into the world: face, voice, fingerprint, palm, gait, DNA. That short list is the actual perimeter.
The realistic threat is purchasable, not exotic
A resourced private adversary’s easiest move is to buy a behavioral dossier from data brokers, not to capture a biometric.
Population-scale collection is already underway
Health sensors and convenience devices are building physiological datasets for non-identity reasons, one repurposing decision away from identity use.
One class attacks by reading you
Emotion AI, micro-expression, and pupil-response systems infer a client’s internal state to manipulate or deceive them. The harm is influence, not impersonation.
DNA is a category of its own
It is shed everywhere, cannot be revoked, can be used to find a client through their relatives, and, uniquely, can be planted to frame.
Voice flipped in about two years
Voice verification moved from security asset to liability as cloning matured. It is now an adversary’s entry point, not a client’s safeguard.
Five clusters that matter.
The field is organized by what an adversary can do with each identifier, not by how the biology works. Five clusters carry the practical risk.
Covert-capture impersonation
Face, voice, fingerprint, palm, iris. Shed or recorded in public and spoofable: the raw material for identity theft and deepfakes, captured without consent and used against the gates that trust it.
The traits you rely on most are your most exposed.Shed-forensic DNA
Left everywhere, unrevocable, and able to locate a client through relatives who never consented. Uniquely, it can be planted to frame. The exposure is forensic targeting, not impersonation.
A relative’s genealogy upload is your exposure too.Buy-the-dossier
Behavioral profiles assembled by brokers and ad-tech, acquired by purchase rather than capture. The most realistic near-term route against a client, and the one defended by policy and removal rather than hardware.
The easiest attack is a transaction.Surveillance-tracking
Gait, wireless sensing, and radar: covert locate-and-track rather than impersonation, arriving in consumer hardware. Not an operational threat from private actors today, but the collection infrastructure is being installed.
Watch this cluster. Do not spend on it yet.Emotion-manipulation
Systems that read the client’s state, emotion AI, micro-expression, pupillometry, in order to influence or deceive. A different kind of harm: nothing is stolen, and the target is judgment itself.
Attacks you by reading you, not by copying you.Inert or protected
Roughly thirty-eight identifiers are inert against a private adversary. Six more are protected-internal, vein and retina among them, and are the safest in the field precisely because they cannot be captured covertly.
Most of the field is noise. Spend nothing on it.What this means for a client.
Identity assembly without physical access
A photograph carries your face, a recording carries your voice, and a broker sells your behavioral dossier. Together they enable impersonation, location, or a deepfake, and none of it requires proximity. Most of the material has already been collected.
Your security tools are your exposure
Face recognition and fingerprint unlock are effective because they are convenient, and convenient because the trait is always with you. The same property deposits those traits on cameras and surfaces everywhere you go. The tradeoff is structural, not fixable.
DNA reaches through your family
A relative’s genealogy database entry can locate you. The trait cannot be altered, cannot be recalled once exposed, and cannot stay fully confidential once any relative shares theirs. Your genetic exposure is a household property, not a personal one.
Today’s collection, tomorrow’s use
Health sensors and wearables are assembling physiological data at population scale for non-identity reasons. The identity use case does not exist yet. The data that would enable it already does, and the repurposing decision will not be yours.
Spend in order: policy first, hardware later.
Six moves, sequenced by cost and payoff. The first one is the reason this assessment points at the data market rather than the sensor aisle.
Cut the purchasable half
Reduce the broker footprint. Data-broker removal and behavioral-profile suppression close the buy-the-dossier route, the most realistic near-term threat. The single most actionable vector, and it runs on policy and process, not hardware. Within the firm this is Obscurity, our digital executive protection program.
Treat face and voice as public. Assume both are already captured and cloneable. Move high-stakes authentication off voice verification, and treat unexpected voice or video contact as unverified by default.
Control the gates you own
Prefer protected-internal modalities. On systems you control, vein and similar internal biometrics are far harder for an adversary to acquire than face or fingerprint. Match the modality to the threat, not to convenience.
Govern wearable and health-data collection. Decide what physiological data is collected and where it goes before the repurposing decision is made for you.
Watch the pools, not the sensors
Track the aggregation layer. National databases, broker inventories, and platform stores are where the durable risk lives. Monitor where the data pools, over years.
Plan for the inert-but-arriving. Wireless sensing and worn-neural capture do not threaten a client today, but the collection infrastructure is being installed. Watch, without spending yet.
The underlying briefs, CB-090 through CB-100.
This page is the synthesis. The eleven briefs underneath it carry the scoring, the evidence, and the per-identifier detail. All of it is searchable in the Intelligence library ↗.
CB-090The Database, Not the Scanner+
Why aggregation, not sensor accuracy, carries the risk.
Read briefCB-091The Safe Ones+
The protected-internal cluster: the most accurate biometrics are the least dangerous.
Read briefCB-092When Bad Biometrics Still Hurt You+
Low-accuracy identifiers that stay dangerous despite poor performance.
Read briefCB-093What You Cannot Withhold+
Exposure routes: shed residue versus worn, internal, clinical, and broker-held.
Read briefCB-094Buy the Dossier+
The broker-profile cluster and the resourced private adversary.
Read briefCB-095Collected Now, Used Later+
Population-scale physiological data gathered for non-identity reasons.
Read briefCB-096Read, Not Impersonated+
The emotion-manipulation cluster: attacks that infer state instead of copying identity.
Read briefCB-097The Trait You Cannot Recall+
DNA as a category of its own: shed, unrevocable, familial, plantable.
Read briefCB-098When Voice Flipped+
Voice cloning turning verification from safeguard to liability.
Read briefCB-099Where the Law Is Looking+
The regulatory gap between neural statutes and the actual threat vectors.
Read briefCB-100The Field of Seventy-Seven+
The full identifier set and the scoring model behind the clusters.
Read briefConfidence and method. The structural findings carry high confidence: the aggregation-over-sensor thesis, the exposure-route distinctions, and the cluster boundaries derive from per-identifier scoring across the full field of seventy-seven rather than from isolated sources. The frontier assessments carry moderate confidence: maturity and adversary-utility judgments for wireless sensing and worn-neural capture describe a fast-moving landscape and are subject to revision as the technology and its vendors evolve.
Standing assessment CB-089, a synthesis of CB-090 through CB-100. Compiled June 2026, client distribution. Baseline adversary: a resourced private actor.
You cannot change your face. You can change where the data pools.
The purchasable half of the biometric threat, the broker dossier, is the half that can be cut this quarter. If the question in front of you is what the data market currently holds on your household, that is the audit, and it starts with a call.
The database is.