What Is Biometrics? Security Pros and Cons for Business

Updated: October 2026

Your team already uses a fingerprint or a face to open their laptops and phones, and nobody signed off on it as a security decision. Some of those setups make the business safer, and some quietly create a list of body data you're now responsible for. Here's what biometrics is, how biometric authentication works on work devices, and where it helps or hurts.

What Is Biometrics?

Biometrics is measuring a part of the body, or a habit, to recognize a person. A fingerprint reader, a face scan and a voice check are all biometrics. So is the rhythm of someone's typing.

There are two families. Physiological traits are things you are: fingerprints, face shape, iris patterns, palm veins. Behavioral traits are things you do: how you type, walk, sign or hold a phone.

Biometric data is the measurement itself. A sensor doesn't keep a photo of your finger. It turns the scan into a template, a set of numbers that describes the ridges or the geometry of a face. The template is what gets compared the next time you touch the reader.

How Biometric Authentication Works on a Work Laptop

Biometric authentication has two steps. First you enroll: the sensor scans you a few times and saves a template. Then, at each sign-in, it scans you again and checks how closely the new scan matches. If the match clears a threshold, you're in.

Where the template lives decides almost everything about the risk. On Windows Hello, Microsoft says biometric data "is stored on the local device only. It doesn't roam and is never sent to external devices or servers." Each sensor keeps its own encrypted database on the machine. Apple says the same about Face ID and Touch ID: the Secure Enclave stores the templates, and the data "never leaves the device" and isn't included in backups.

The fingerprint isn't the credential either. In Windows Hello for Business, the scan unlocks a private key that the TPM protects. The key signs the sign-in request, and the identity provider only ever sees that signature. If a laptop's TPM is missing or off, our guide to TPM not detected walks through the fix.

Biometrics as an Unlock, Not a Password

This is the distinction that matters for a business. A biometric can do two very different jobs.

In the good setup, it's a local gesture that releases a key. That's how Windows Hello and passkeys work. The FIDO Alliance puts it plainly: biometric processing "stays on the device and is never sent to any remote server - the server only sees an assurance that the biometric check was successful." A stolen laptop gives an attacker a device, not a database of fingerprints.

In the risky setup, the biometric is the secret, and templates sit in one central system. Think of a fingerprint time clock that stores every employee's template on a server. Breach that server and you've leaked something people can't change.

NIST's digital identity guidelines, SP 800-63B, finalized in August 2025, draw the same line. Biometrics "SHALL only be used as part of multi-factor authentication with a physical authenticator." It also gives the reason: biometric characteristics "do not constitute secrets." You leave fingerprints on every coffee cup.

One more catch: every biometric login has a fallback. When the reader fails, the device asks for a PIN or password. That fallback is only as strong as the PIN, a point this thread makes bluntly.

How Accurate Is It? False Accepts, False Rejects and Liveness

Every biometric system trades two errors. A false accept lets the wrong person in. A false reject locks the right person out. Tighten the threshold and false accepts drop while false rejects climb.

Vendors publish targets for both. Microsoft requires Windows Hello fingerprint and face sensors to keep the false accept rate below 0.001 percent, about 1 in 100,000. NIST sets a floor of one false match in 10,000 or better, measured across all demographic groups. That last clause matters: a system that works well for one group of users and poorly for another fails the test.

Accuracy doesn't stop spoofing. In 2013, the Chaos Computer Club unlocked an iPhone 5s with a fingerprint photographed off a glass, printed and cast in wood glue. Their spokesperson called it "plain stupid" to use something you leave everywhere every day as a security token. The lesson stuck: a copy can pass if the sensor only checks the pattern.

The answer is presentation attack detection, often called liveness. It checks that a real, present person is in front of the sensor, not a mold, a photo or a video. NIST requires it for face recognition and recommends it for fingerprints and iris. Windows Hello face sign-in uses an infrared camera for this reason, which is why a plain webcam can't enroll a face. Deepfake video raises the stakes, which IBM covers well here.

Biometric Security: Pros and Cons for Business

Here's how it nets out for a small company or an IT team running a fleet.

The admin row has a twist. Once people sign in with a face every day, they forget the password they still need for a few old apps. This r/sysadmin thread lands on two fixes: self-service password reset, or dropping password rotation once passwordless sign-in is the standard.

If passwords are still the fallback, it's worth knowing which ones attackers try first. Our list of the most common passwords shows what a weak fallback looks like.

Biometric Data and the Law

Collecting biometric data turns a security tool into a privacy obligation. Two laws come up most.

Illinois' Biometric Information Privacy Act, passed in 2008, requires written consent before a company collects fingerprints or face geometry. It lets people sue: $1,000 per negligent violation and $5,000 per intentional or reckless one. In February 2021, a court approved a $650 million settlement against Facebook under the law.

In the EU, GDPR Article 9 treats "biometric data for the purpose of uniquely identifying a natural person" as a special category. Processing it generally needs explicit consent or another narrow legal basis. Texas and Washington have their own biometric laws too.

The practical takeaway for IT: device-local biometrics like Windows Hello and Face ID keep the templates on the employee's device, so the company never holds them. A central biometric system is a legal project, not only an IT one. Loop in whoever owns privacy before you buy one.

A Biometrics Rollout Checklist for Business

If you're turning on biometric sign-in across a company, this order keeps it safe and legal:

1. Keep templates on the device. Prefer Windows Hello, Face ID and passkeys over any system that stores templates centrally.
2. Require hardware-backed keys. In Windows Hello for Business, set the policy to use a hardware security device so keys live in the TPM, not in software.
3. Pair it with a strong PIN and a recovery path. Self-service password reset or a second authenticator covers the day the sensor fails.
4. Buy the right sensors. Infrared cameras for face sign-in, and fingerprint readers that meet Microsoft's requirements. Newer laptops with Enhanced Sign-in Security match fingerprints on the sensor itself.
5. Offer a non-biometric option. Some people can't or won't use a fingerprint. A security key or PIN has to work just as well.
6. Write it down. If you collect templates centrally, publish the purpose, get written consent and set a deletion date.
7. Check coverage across the fleet. Know which devices have a TPM, Hello enabled and a working sensor. OpenFrame can run that check as a script across a client's devices and collect the output in one place.

Biometrics is one layer of identity, not the whole of it. Sign-in, MFA, provisioning and access reviews all sit around it.

Biometrics, in Short

Biometrics recognizes people by a body trait or a habit. Used as a local unlock for a device-bound key, it's faster than a password and hard to phish. Used as a central secret, it creates data nobody can ever change and a legal duty to protect it. Keep the templates on the device, keep a strong fallback, and treat any central biometric database as a privacy decision first.

Next, see how sign-in, MFA and access reviews fit together in our guide to IAM solutions.