Identity Verification (Gartner)

Gartner published its first Magic Quadrant for Identity Verification in 2024. Forrester had been mapping the same market since a Now Tech report in the first quarter of 2018.

Six years is the gap between the two firms' first serious look at this category, and it is visible in what each one measures.

The July 2026 edition is Gartner's third. It was published on 28 July 2026 and credited to Nayara Sangiorgio, Akif Khan and Zachary Smith.

The July 2026 Magic Quadrant for Identity Verification, and the three confirmed Leaders

Three vendors hold Leader positions in the 2026 quadrant, and each one arrived there by a different route.

Persona is a Leader for the second consecutive year and is positioned highest on Ability to Execute for the third consecutive year. That combination is worth reading carefully: it means the firm was placed highest on execution in an edition where it was not yet a Leader, which happens when the vision axis lags the execution axis.

Incode is a Leader for the third consecutive year, which makes it a Leader in every Magic Quadrant for Identity Verification Gartner has published since the first one. Three for three is a different kind of claim from a single placement, because it spans the whole life of the report.

1Kosmos is a Leader for the first time. It was placed as a Challenger in 2025. A one-cycle climb from Challenger to Leader is the single most informative movement in the chart, and it is the kind of change a reader who only follows one analyst firm would never see.

Outside the Leader rung, Nametag is named as a Visionary and LexisNexis Risk Solutions is placed as a Niche Player. Both placements come from the vendors' own published statements.

Gartner arrived six years after Forrester started mapping this market

The two lineages are worth setting side by side, because they show two firms converging on the same market size from opposite directions.

Forrester's coverage runs from a Q1 2018 Now Tech report that mapped 38 providers, through a Q3 2022 Landscape of 28 providers, to a Q4 2022 Wave that scored 12 providers against 22 criteria. By the Q2 2025 Landscape the count had grown to 34 vendors, and the Q3 2025 Wave followed.

Gartner's coverage starts in 2024 and reaches its third edition in 2026.

The convergence is in the scored field. After seven years and four Landscape or Now Tech mapping exercises, Forrester's last Wave put 12 providers on a scored grid. Gartner's 2026 quadrant evaluates a field of about the same size. Two firms, two methodologies, two different starting dates, and roughly one conclusion about how many vendors are worth scoring in this market.

That agreement is the useful part. It means a buyer who has been told the identity verification market has thirty-plus credible providers is looking at a mapping exercise, not a scorecard. Thirty-four vendors can be described. Twelve can be ranked.

The Critical Capabilities report answers a different question

The quadrant ships alongside a companion 2026 Critical Capabilities for Identity Verification, and the two documents do not always agree.

In the Critical Capabilities, Persona ranks first across two use cases, Risk Mitigation and Consumer. 1Kosmos records the highest product score for Workforce use cases at 4.28 out of 5.

Read that against the quadrant and the shape of the problem becomes clear. A Magic Quadrant scores vendors as companies: their strategy, their execution, their ability to be bought, deployed and supported. Critical Capabilities scores the product against a specific job. A vendor can lead one and trail the other, and both results can be correct.

This is the practical argument against using Leader status as a shortlist. It is a statement about a company, not about whether the product will pass your use case.

Three vendors, two firms, one contested rung

One vendor holds a Leader position under both firms. Persona took the highest possible scores in vision, deepfake detection and roadmap in Forrester's Q3 2025 Wave, and Gartner's 2026 quadrant places it highest on Ability to Execute. Incode and 1Kosmos are Leaders in Gartner's chart; their standing in Forrester's most recent Wave is not established by either firm's public material, and this article does not assume it.

The divergence runs the other way too, and it is sharper. LexisNexis Risk Solutions was a Leader in Forrester's Q4 2022 Wave, with maximum scores in seventeen of its twenty-two criteria. Gartner's 2026 quadrant places the same vendor as a Niche Player. Four years is a long time in a market where the threat model turns over annually, and both placements can be true of the same company at different moments. A buyer who read only the 2022 scorecard would be shortlisting on evidence the other firm has since superseded.

Meanwhile the field itself is being reassembled. Entrust acquired Onfido in 2024, and Onfido was one of the twelve providers in Forrester's Q4 2022 Wave. Signicat acquired Inverid in 2025. Each acquisition removes a name from the next edition's roster and folds its customer base into a vendor that is already placed. A buyer working from a two-year-old comparison is reading a market that no longer exists in that shape.

The scorecards are republished annually. The consolidation is not.

What the roster cannot tell you

Neither report tells you what a verification check costs you in conversion, and that is the number most buyers feel first.

The Forrester-side coverage of this market is on this site at Identity Verification Solutions, and its argument is that every check costs conversion while each generation of verification is defeated by the previous generation's breached data or the current generation's synthetic media. The problem does not get solved. It moves.

That framing and the quadrant are not in conflict. They are answering different questions. The quadrant tells you which companies are strongest. It does not tell you how much friction your own funnel will absorb, or which attack your chosen vendor handles well and which one it handles adequately.

Presentation attacks and injection attacks are different problems with different defenses. A vendor profile that says identity document verification without saying which of the two it handles best has told you less than it appears to.

What to test before you shortlist

Which use case are you actually buying for? Workforce, consumer and risk mitigation are scored separately in the Critical Capabilities for a reason, and the leaders differ across them. Name your use case before you read either chart.

Has the vendor been placed more than once? A single Leader placement and a four-edition streak are different evidence. Ask what the vendor's placement was in the previous edition and why it moved.

What did the vendor acquire, and when? If a name you were evaluating has been absorbed, you are now evaluating the acquirer's roadmap for it. Ask what happens to the product line.

Can the vendor show you both attack types? Presentation and injection are separate defenses. Ask for a demonstration of each against your own document types rather than a reference list.

What does a failed check cost you? The quadrant cannot answer this. Your own abandonment data can, and it should set the friction budget before any vendor demo does.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The Forrester evaluation of this same market is covered on this site at Identity Verification Solutions (Forrester), where the argument is that every check costs conversion and that the problem moves rather than resolves: each generation of verification is defeated by the previous generation's breached data or the current generation's synthetic media.

Where a verified identity gets used afterward is a market of its own: User Authentication, which covers the credential side sitting downstream of a successful verification.