Close

New Research from CDW on Workplace Friction

Learn how IT leaders are working to build a frictionless enterprise.

Jun 15 2026
Cloud

How One Company Went From Tech Startup to FedRAMP 20x

With artificial intelligence-enabled fraud attacks up 75 times over five years and hundreds of billions of dollars in estimated annual federal losses, Persona is betting that the government's need for better identity proofing is only accelerating.

When the FedRAMP Program Management Office launched its 20x pilot last year, Persona, an identity verification platform, was already deep into the traditional Rev5 authorization process. Rather than picking one track, the company decided to run both in parallel — an unusual and demanding choice that few cloud service providers have attempted.

"It was intense, to say the least," says Stephen Eng, Persona’s federal compliance lead and security compliance engineer. Eng previously worked in government security as a cloud security engineer at NASA, a security compliance officer at the FDA and as a FedRAMP assessor before joining Persona. "The 20x process really didn’t lower the security bar. It definitely raised it, especially in the pilot," he says.

Today, Persona holds FedRAMP moderate authorization through the 20x process and has achieved a "ready" designation under the traditional Rev5 pathway. Eng is unequivocal about which route he'd recommend to other companies weighing the decision: "Definitely 20x is the route to go, because it’s a good way of showcasing how secure your system is. I think 20x is definitely the future of security certifications in general."

Click the banner below to keep your agency’s cloud secure.

 

Why Pivot To Serve the Federal Government, and Why Now?

The decision to go federal was a far cry from the company’s beginnings. Persona was founded in late 2018 by two tech worker roommates in San Francisco who saw how fragmented and painful identity verification was for businesses. They wanted to build broad identity infrastructure for fintechs, marketplaces and e-commerce companies that were stitching together multiple vendors and losing customers to bad onboarding.

The pivot toward government just eight years later was driven by a structural reality that Bobby Kozyra, Persona’s public sector lead, frames in blunt demographic terms.

"If you look at the federal employee count from the 1950s to today, you effectively see a trend down and to the right — roughly fewer employees," Kozyra says. "If you overlay the federal employee count alongside U.S. population growth, what that means is you genuinely have fewer people serving more people, overall and over time." The workforce reductions that swept federal agencies during the past administration only sharpened that math.

Kozyra, a former naval officer and federal civilian who worked at the State Department, says the company also saw a gap in the market.

"There really were only a few options that the federal government could use for a wide range of both external citizen-facing experiences and internal experiences that they might need for their own workflows," Kozyra says.

Persona, for its part, hopes to help the government reduce identity fraud in a variety of agency settings.

The Government Accountability Office estimates the federal government loses between $233 billion and $521 billion annually to fraud, though how much of that is addressable through identity verification is difficult to quantify.

The realistic goal, Kozyra suggests, is meaningful reduction rather than elimination — much like in the private sector. "A J.P. Morgan or Bank of America isn't at zero with their fraud loss. But I do think the number is meaningful enough that throughout government, there's going to need to be more thoughtful ways for people to prove who they are online."

The urgency is compounding. Persona says its detection of deepfakes as a threat vector has increased 75 times over between 2021 and 2026, and the White House recently released a memo directing agencies to fight artificial intelligence-enabled identity theft and fraud — a signal that the threat has reached a tipping point for both the private and public sectors. “The widespread adoption of LLM tools has put the ability in just everyday people, rather than sophisticated actors, to have more sophisticated fraud attacks,” Kozyra says.

REDUCE RISK: Check out our security spend prioritization checklist.

Where Identity Proofing Meets Citizen-Facing Use Cases

The most visible applications for Persona's technology are in citizen-facing services in which individuals must prove their identity to access a government benefit or complete a high-stakes transaction.

Consider tax returns. The IRS currently uses 76 identity filters to determine whether the person filing a return is who they claim to be. When those filters flag a submission, the filer must go through identity proofing — submitting a government-issued ID and potentially biometrics — before receiving their refund. Persona sees an opportunity to support that process.

Similar dynamics play out across federally funded, state-administered programs such as unemployment insurance, the Supplemental Nutrition Assistance Program, Medicaid and Medicare, for which states often map their own security requirements to FedRAMP standards. Kozyra notes that identity proofing is just one component of the adjudication process for benefits eligibility, but it is a critical one.

Some state-level use cases are already live and surprisingly specific. In Georgia, citizens can now transfer property deeds online. Previously, the process required only form-field information. Now, an online transfer triggers an identity verification experience through Persona. "You can, of course, still go and do it in person," Kozyra says, "but if you want to do it online, you would go through Persona."

What’s Next for Persona’s Federal Adoption?

Persona does not yet have any official federal agency customers. It does have a growing portfolio of state, municipal and higher education clients, and is in active discussions with multiple federal agencies about citizen-facing use cases — particularly around account recovery and benefits eligibility.

The FedRAMP authorization opened the door. Now, the company must walk through it. For Eng, who still considers himself a public servant at heart, the motivation is personal. “I still have very deep ties to the federal government. From their perspective, all of these AI deepfakes, the ubiquity of LLMs, it’s making their job harder. And if they don’t have the right tools to adapt to this new AI climate, there are going to be a lot of problems.”

Whether 20x delivers on its promise to accelerate secure cloud adoption across government remains to be seen. But Persona's dual-track bet suggests the company is positioning for a long game in public sector identity.

Igor Suka/Getty Images