The biometric threat to principals

The scoring framework

Every verdict in the firm's biometric threat series traces back to one scoring analysis. This annex to CB-089 sets it out so its conclusions can be assessed as reasoning rather than taken on trust: the unit of analysis, the lenses applied and the adversary each modality is judged against, with candor about where it falls short of a reproducible model. For advisors and technical reviewers weighing how far the series should shape a principal's biometric decisions.

The database, not the scanner

Your Palm Is in Two Databases

A fingerprint reader on a door captures one trait at one moment, but the reading is enrolled into stores that are increasingly linked, breached, brokered or queried. This brief asks which biometric stores hold a principal's records, who governs each, and what lever exists to remove a template when the holder changes. Built from operators' own published figures for national, forensic and vendor systems. For family offices weighing which enrollments to accept.

The trait you cannot recall

You Never Took a DNA Test

A stolen fingerprint is a credential problem, and that frame is routinely applied to DNA, where there is no genomic login to defeat. This brief asks what threat a principal's genome actually poses, including exposure through a relative's test and a sample that arrives somewhere the principal never was. Built from peer-reviewed genetic genealogy and forensic research and dated cases. For family offices whose principals never took a DNA test.

When voice stopped being proof

Amazon's Replacement for a Voiceprint

Two large cloud providers have retired their stand-alone speaker verification services just as cloned voices became cheap and convincing. This brief asks what a voice can still prove on its own, where a principal's enrolled voiceprints may still be in use, and what should be layered beside them. Built from vendor retirement notices, a broadcast test of cloned voices against financial institutions and industry analysis. For principals and family offices.

The gap is the price of a workable definition

The Law Carves Out Pupil Dilation

Five states have written neural data into their privacy statutes, and each draws a limit on what counts, one of them naming pupil dilation and motor activity as outside it. This brief asks why those limits exist, what falls outside them, and what that means for a principal exposed through wearables and headsets. Built from the statutes, their legislative analyses and federal proposals as of September 2026. For counsel and family offices tracking neural and biometric privacy.

Coverage is not resolution

Two Dollars, Seventeen Minutes

In June 2026 Swiss researchers showed language-model agents resolving location traces to named people unattended, just before California's broker deletion platform became enforceable. This brief asks what protection and removal programs report to those paying for them, and whether it reveals what an adversary can still learn. Built from that study, re-identification research, independent tests of removal services and state agency reporting. For family offices and boards grading a protection program.