Skip to content
ThreatVet

We test face and fingerprint liveness the way a spoofing attacker would.

Presentation attack detection and injection attack detection, aligned to ISO/IEC 30107-3 and CEN/TS 18099. We report APCER, BPCER, penetration rate and attack difficulty, so you know exactly what your liveness check stops and what it does not.

Scope of this service. We test aligned to ISO/IEC 30107-3 and CEN/TS 18099. We are not an accredited certification lab, and this testing does not issue a formal certification.

Request a scoped quote

What the attacker actually does

Presentation attacks fool the sensor. Injection attacks skip it.

  • PresentationPrinted and screen replayPresents a photo or a video of the real person to the sensor.
  • Presentation3D artefactsUses masks, silicone or moulds to imitate a real face or fingerprint.
  • PresentationDeepfake and synthetic mediaDrives a generated face or voice through the capture path.
  • InjectionCapture bypassSkips the real sensor and feeds frames straight into the pipeline.
  • InjectionStream and API injectionInjects crafted media into the app or API behind the camera.

What we report

The metrics from ISO/IEC 30107-3, computed from your own runs.

APCER
Attack presentation classification error rate: the share of attack presentations wrongly accepted as genuine.
BPCER
Bona fide presentation classification error rate: the share of genuine users wrongly rejected.
Penetration rate
How often a given attack instrument gets through, across attempts.
Attack difficulty
The skill, cost and effort an attack instrument takes to build and use.

How testing runs

We build real attack instruments, run them against your system, and compute the standard metrics. The report is plain about what got through and how to harden it.

  1. 01

    Scope and PAD levels

    Agree the modalities, the target systems and the attack levels in scope.

  2. 02

    Attack instrument creation

    Build the presentation and injection instruments the scope calls for.

  3. 03

    Presentation testing (PAD)

    Run attack instruments against the live sensor and record outcomes.

  4. 04

    Injection testing (IAD)

    Test paths that bypass the sensor and reach the pipeline directly.

  5. 05

    Metric computation

    Compute APCER, BPCER, penetration rate and attack difficulty from the runs.

  6. 06

    Report

    A clear report of what passed, what got through, and how to harden it.

Standards we align to

Standards and what we map to each
FrameworkHow we align to it
ISO/IEC 30107-3The presentation attack detection testing method and metrics we align to.
CEN/TS 18099Injection attack detection guidance we align our IAD testing to.

Aligned to these standards for testing and reporting. ThreatVet is not an accredited certification body.

Scope a biometric test

Tell us your modality and the systems in scope. We will scope the testing and send a quote.

Request a scoped quote