Adaptive Security's second-ranked page in our winner research explains deepfake identity verification as a set of layered controls and catalogs where each layer fails. Our directory cannot judge failure rates, but it records which controls the market actually ships. Across the 60 tools we track, the layers are present in very uneven numbers, and the thinnest layer is the one aimed at the strongest current attack.
The control census
| Control named in the tool's record | Tools of 60 |
|---|---|
| Liveness detection | 28 |
| Document authentication | 12 |
| Device signals or integrity | 10 |
| Injection-attack detection | 9 |
| Behavioral analysis | 5 |
| Face matching | 4 |
Read the table from the attacker's side. Presentation attacks (a photo, a screen, a mask held to the camera) meet liveness in 28 tools and face matching in a handful as a named control. Injection attacks, where synthetic video is fed straight into the capture pipeline, meet a named defense in 9. Every one of those 9 also ships liveness, so the full two-layer stack against camera-pipeline attacks exists in 15% of the market. Adaptive's layered-defense argument is right; the census shows how far the average product is from acting on it. The KYC subset is better covered than the general market (all 15 expose APIs and 13 check live video), as our KYC count shows.
A second honesty check belongs beside the control census: 41 of the 60 tools publish no accuracy claim at all in our records, and among those that do, the claims use incomparable tests, which our directory census documents. Controls are at least countable. A vendor either names liveness, document authentication, and injection detection in its record or it does not, and procurement can verify each one in a demo. That is the practical use of this census: turn the layered-defense slide into a checklist, and make each finalist show the layer working rather than cite a percentage.
To see one layer work, the DeepfakeDetect app runs the media-analysis layer free; the five-layer guide assembles the full stack.
Sources: Adaptive Security, Deepfake Identity Verification: How It Works, Where Controls Fail, and How to Build Layered Defenses; this site's detection tool directory, 60 tools, records verified September 2025. Counts are of controls named in vendor records, not of tested effectiveness.