What Behavioral Biometrics Misses Inside the Firm

Behavioral biometrics works, and the market just said so. The open question is what changes when the session belongs to an employee, a contractor, or an AI agent inside the company instead of a customer in a banking app.

What the Visa deal tells us

On August 3, 2026, Visa announced a definitive agreement to acquire BioCatch for $2.4 billion in cash. The deal is expected to close by the end of Visa’s fiscal second quarter of 2027, subject to regulatory approvals. BioCatch says it protects 1.8 billion devices and 760 million users, serving more than 350 banks across 21 countries. It describes collecting more than 3,000 anonymized data points as people use digital banking platforms, including keystroke and mouse activity and touch screen behavior.

That is a strong result for the approach. Measuring how people interact with a device is a sound way to tell who is on the other end.

Where the category has been pointed

The use cases BioCatch describes are customer-facing: account opening fraud, account takeover, scams, and mule accounts. Its public material has recently added AI agent detection at account opening. The buyer is the fraud and financial crime team, and the session is a customer’s session in a banking application.

That makes sense. It is where the losses showed up first.

What changes inside the firm

The same signals matter, but the setting is different:

	Behavioral biometrics for customer fraud	Mimoto, inside the enterprise
Whose session	Customers in banking and commerce apps	Employees, contractors, vendors, and agents in internal systems
Typical buyer	Fraud and financial crime teams	The CISO and security team
What counts as a threat	Account takeover, scams, mule accounts	Stolen credentials, hijacked sessions, insider misuse, impersonation by people or agents, inauthentic workers
Question asked	Is this session risky?	Is it a real human, and is it the right person?
Where it responds	Fraud engines and case management	Native enforcement, or the SIEM and other SOC tools the security team already runs

The security question is also sharper. Inside a company, a valid credential reaches privileged systems, source code, and sensitive data. Mimoto builds around the specific person: a verified profile for each individual, checked all session long, so a stolen login or a handoff to someone else stands out against that person’s own pattern.

One signal is rarely enough

An analyst quoted in coverage of the Visa deal noted that behavioral signals can be weak predictors in isolation. That fits Mimoto’s approach: no single tell decides anything. Typing and mouse movement are one part of the picture, alongside how a person uses their apps, their device and connection, and the context of the session, weighed together with advanced pattern matching and anomaly detection. Mimoto never captures what someone types.

The honest caveats

• Behavioral biometrics vendors, BioCatch included, are adding AI agent detection. The gap is not that no one is working on agents. The gap is whose sessions are covered and who owns the response.
• If you already run behavioral biometrics on your customer channels, keep it. Mimoto is built to work alongside existing tools, not replace them.
• BioCatch’s Visa deal has not closed, and product plans after closing are Visa’s to describe.

A simple test

Ask your security team: if a contractor’s session, an administrator’s session, or an employee’s laptop were taken over today, what would tell us during the session? If the answer is “the customer-fraud tool” or “we would find out later,” that is the gap.