Decentralized Identity

KuppingerCole’s Buyer’s Compass for decentralized identity solutions is a structured starting point for vendor selection. It guides organizations to first identify primary use cases, then evaluate vendors against functional and non-functional selection criteria, request and rate vendor information, ask targeted follow-up questions, and narrow to a shortlist for deeper RFIs and proofs of concept—while ensuring technical and organizational prerequisites are in place. The approach emphasizes aligning product capabilities with the most relevant use cases, rather than treating selection as a generic feature comparison.

Decentralized identity is positioned as an IAM sub-category shaped by blockchain development and rising public demand for control over personally identifiable information (PII). Traditional account-per-institution models create data “honeypots” for organizations and encourage insecure password reuse by users; the growth of uniquely identified IoT devices worsens siloed identity challenges. Decentralized identity aims to return control of identity attributes to individuals, improve user experience, support digital document integrity, and increase resiliency. The ecosystem model commonly involves Issuers, Holders, and Verifiers: issuers provide credentials, holders store them in digital wallets, and verifiers validate claims cryptographically using an immutable ledger and revocation records.

Top use cases include identity management, new customer onboarding, reusable KYC, strong customer authentication, and proof of age with selective disclosure. Selection criteria span functional capabilities (e.g., verifiable claims, zero-knowledge proofs, wallet security, interoperability, PII storage location, smart contracts, APIs/SDKs, recovery) and non-functional vendor factors (e.g., deployment models, maturity, documentation, standards participation, partner ecosystem, roadmap, pricing, privacy focus). The document also highlights prerequisites—such as hardware capacity, multispeed IAM integration, iterative cybersecurity, metrics, governance, incident response, and business case discipline—to avoid adopting blockchain where it doesn’t fit organizational goals or maturity.

• Decentralized identity is described as a sub-category of Identity and Access Management (IAM).
• Traditional identity models require each institution to run its own identity process for user accounts.
• Institutional storage of user accounts creates a “honeypot of data.”
• Password reuse is cited as a common user behavior that creates security weaknesses.
• The increase of uniquely identified IoT devices exacerbates siloed identity data problems.
• Decentralized identity solutions commonly define roles of Issuers, Holders, and Verifiers (with vendor-specific naming variations).
• The blockchain ledger is presented as recording credential issuance and future revocation for later verification.
• Digital credentials are stored by the individual in a digital wallet.
• The top five use cases listed are ID Management, New Customer Onboarding, Reusable KYC, Strong Customer Authentication, and Proof of Age.
• The document states that PII data should not be stored on-chain because blockchain immutability conflicts with “right to be forgotten” expectations.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “Both outcomes create security weaknesses in managing digital identity.”
• “The increase of uniquely identified IoT devices exacerbates problems of siloed identity data.”
• “Returning control to individual users is a central goal of most solutions, but the level of ownership varies between vendors.”
• “This implies that no PII data – which has the right to be forgotten – should ever be stored on-chain.”
• “Blockchain solutions pose challenges to account information recovery because typical password recovery services are not possible in a decentralized architecture.”
• “A multispeed approach to IAM that addresses both predictable processes and unforeseen adaptations like BYOID is required”
• “Adequate metrics must be defined for measuring the effectiveness of the project.”
• “Organizations can fall prey to the blockchain hype, and integrate this technology when it does not align with the organization’s goals, use cases, or maturity.”
• “A weakness of blockchain solutions is that they cannot achieve scalability without compromising decentralization.”