Persona’s Sentinel helps you assess risk at every moment

You've built rigorous identity verification flows. You're running liveness detection, document checks, and behavioral analysis. And when users make it through, you rightfully clear them as trusted. But when users aren’t in a verification flow, you lose insight into the device, network, and behavioral signals that could flag a major risk. 

Sentinel extends passive signal collection to any moment in the user's life cycle. It gives you continuous coverage that’s natively connected to the systems and records you have with Persona, and it’s now generally available to all Persona customers. 

How Sentinel works

Sentinel is a lightweight toolkit that you can embed in your website (as an iframe) or iOS and Android apps (as an SDK). It passively collects device and network signals without adding friction for users. These include:

• Device or browser fingerprint

• Rooted or jailbroken detection

• Emulator detection

• Device system attributes

• IP address and intelligence

• Geolocation

• VPN, Tor, and proxy detection

You can use Sentinel to:

• Automate decisions based on the results: You can kick off a new, risk-based flow behind the scenes based on each Sentinel Transaction. Organizations commonly use Sentinel to automatically determine whether to approve, step up, manually review, or block users. 

• Passively collect helpful data points: Sentinel can collect signals at any point you define, such as when a user goes into their account settings or in the moments before they begin an identity verification flow. 

• Create and enrich Accounts: Persona bundles the Sentinel signals into a Transaction, a generic record of events that connects the data to an existing or newly created Persona Account. Use the insights to better understand users without requesting verifications at inconvenient moments, and to establish a baseline for risk assessment.

• Expand results with link analysis: Connect the Account and data from Sentinel to Persona’s Graph to see if there’s a link with previous users. These links can help you spot account sharing, mass-created accounts, farmed accounts, and coordinated fraud attacks. 

Sentinel builds on Persona’s comprehensive identity platform

One of Persona’s earliest innovations was the creation of a highly configurable system for automating onboarding verifications. Customers collect a rich set of network, behavioral, device, and visual signals from users during these verification flows, and automate the user’s next step based on risk levels. 

As Persona’s platform expanded, we created new building blocks (including new verification methods, data sources, integrations, case review systems, and AI agents) that organizations can pick and choose from to build their end-to-end identity and risk systems. 

But experienced fraudsters know that many fraud detection systems focus on high-risk moments, such as onboarding, changing account settings, and initiating large transactions. They also know that even the strictest verification flows don’t offer insight into what happens before or after verification flows. Some let their guard down or make mistakes when they’re not going through a verification flow. And although you don’t want to rely on these mishaps, we’ve found they occur regularly.  

Sentinel helps you catch these mistakes. More importantly, it provides additional insights and context you can evaluate alongside everything you know about your users, including the in-house and third-party data points you add to Persona. 

Unlike point solutions, it natively works alongside Persona’s highly customizable and configurable product suite, including Dynamic Flow for building risk-based verification flows and Graph for real-time link analysis. 

5 ways Sentinel helps fraud fighters make more accurate  decisions

When a high-risk signal surfaces outside of a verification, fraud teams generally block the user outright or require a new verification check. Sentinel reinforces your ability to make either decision by providing the crucial context without adding friction. 

Some of the common use cases for Sentinel during the beta release were: 

1. Improving decisions before and during verifications

By collecting signals with Sentinel, you can automate decisions before users enter a verification flow. This allows you to automatically block high-risk users based on the insights or connections to known fraudsters and avoid running verification checks. 

Sentinel can also provide additional context and be complementary to the verification and reverification checks you run during onboarding and at high-risk moments. As a result, you can create more precise rules based on your observations about the user at several points, and the increased assurance allows you to send fewer accounts to manual review.

2. Stepping up potentially risky users to increase assurance

Sentinel can capture snapshots of a user's device and network signals at moments you choose. If the results are consistent with the user’s history, you can allow them to proceed without adding friction. But if the device changed or the IP is risky, you can step them up to a reverification check, such as a government ID or selfie check. 

You can compare insights from the user’s initial verification and Sentinel results with what you collect during reverification. The reverification process also allows you to collect additional signals, such as liveness detection results from a selfie. 

3. Collecting signal continuously to mitigate risk

Sentinel allows you to treat signal collection as an ongoing practice. You can add the results to a user’s records, allowing you to monitor trends and better understand what’s abnormal for each user. This can be helpful for assessing trust and risk. 

For example, someone who frequently travels for work might be connected from different IPs, but you’ll know that’s normal for that user. On the other hand, someone who fell victim to a scam and shared their login credentials might have a highly unusual login from a new device that’s located on the other side of the world. 

4. Supplementing API-based verifications

Some organizations implement Persona into their verification flows via direct API rather than using Persona’s Inquiry SDK, but the API-based verification might collect fewer risk signals. In these cases, the organization can use Sentinel to capture some of the risk signals they’d otherwise miss, which can improve fraud detection during the verification. 

5. Detecting and shutting down fraud rings

By using Sentinel and Graph, you can quickly spot when there’s one device behind many accounts, or many devices connected to one account, across your entire user base. This makes Sentinel especially useful for catching people who are sharing, selling, or mass-creating accounts.

Sentinel is now available for all Persona customers

We worked with several customers who frequently experience large and sophisticated attacks to develop, test, and refine Sentinel. Now, it’s available for all Persona customers. 

Build comprehensive risk profiles by capturing signals at every life cycle moment you care about, avoid running unnecessary verification checks, and capture more fraud without adding friction.

Learn more about passive signals from Persona, or contact us (or your account manager) to find out how Sentinel can help you bolster fraud protection without adding friction.