In the past few years, the tech industry has been trying to develop an alternative to passwords for user authentication as part of an effort to reduce the threat of account theft. Trusona Inc., one of the startups leading the push, today announced it has secured a $10 million funding round led by Microsoft Corp.’s venture capital arm.

The technology giant was joined by returning backer Kleiner Perkins Caufield & Byers. Trusona will use the capital to generate more demand for its namesake authentication platform, which employs a multistep identity verification process instead of passwords. The thoroughness with which the software vets users can be customized based on the sensitivity of an application. 

Trusona Essential, the most basic version of the startup’s platform, relies on a mobile app to perform authentication. Users must verify their identify every time they launch the application by scanning their fingerprint or, if they want a more traditional login experience, with a 6-digit PIN. It’s designed for protecting services that have to prioritize convenience at least as much as security.

The two other versions of Trusona’s software target more sensitive use cases such as verifying bank transactions and data access requests. Users must prove that they are who they say they are upon sign-up either by submitting personal identity document or going through an in-person check, and then provide up to four different credentials each time they want to access an asset protected by the platform.

Trusona tops it off by using a patented security engine to perform the equivalent of watermarking logins. The mechanism is designed to prevent hackers from forging user credentials, which is typically achieved by intercepting login requests at the network level and then re-sending them to trick the target service. Trusona’s software automatically rejects an access attempt if the cryptographic stamp matches that of a prior request.

The startup believes that its technology addresses an important need in the market. About 80 percent of cyberattacks exploit stolen passwords, which means that using an alternative method has the potential to significantly improve an organization’s security posture. 

Image: Pixabay