Contact Center Identity
As organizations that handle customer payment info, contact centers are subject to the PCI DSS 3.2 multifactor requirement that they must "secure all individual non-console administrative access and all remote access to the CDE using multi-factor authentication."
With agents taking payment information over the phone, multifactor authentication is a must-have for secure contact centers.
NIST-Standard 15 min timeouts
NIST requires that sessions automatically time out after a fixed amount of time. Many organizations use 15-minute timeouts, which can mean repeated MFA challenges throughout the workday.
Twosense automatically extends user sessions based on behavioral data, saving time and reducing employee interruptions.
Secure contact centers don't allow mobile devices
Traditional MFA simply doesn't work for organizations without mobile devices.
Without phones at desks, most MFA solutions cannot be implemented: push-based MFA like Duo, TOTP authenticator apps, or SSO-included MFA like Okta Verify are all unavailable to call centers.
Hard tokens are expensive and difficult to manage
Contact centers need solutions that don't require specific hardware issued to employees.
Tokens like Yubikey are expensive to purchase and replace. Employees have a tendency to forget or break their hard tokens. Plus, 150 % annual staff turnover means constantly assigning new hardware tokens to employees and de-authorizing the tokens of ex-employees.
Time is Money
With every MFA challenge taking at least 15 seconds, interrupting your employees can cost your organization.
NIST-standard 15 minute session timeouts can mean near-constant multi-factor challenges. Frequent interruptions mean lower employee performance. Each MFA challenge takes at least 15 seconds, which add up throughout the day. These delays are both expensive and increase customer wait times.
Behavioral Biometrics and Machine Learning
Twosense provides identity verification via Passive Biometrics.
100 % software - no mobile app or hardware tokens required.
Unphishable - users are not part of the multi-factor process, and thus can't be fooled into granting access.