Veridas wins CEN/TS 18099 High certification for injection-attack defense

Veridas said it has earned the CEN/TS 18099 Level High certification from CLR Labs, a milestone that it says positions the company for upcoming European anti-money-laundering rules taking effect in July 2027. The standard is designed to test resistance to injection attacks, a fast-growing fraud method that manipulates data flows rather than bypassing the camera.

Why it matters: - Injection attacks are becoming a more scalable fraud tactic as generative AI lowers the cost and complexity of digital fraud. - CEN/TS 18099 is the first official global testing methodology focused specifically on resistance to injection attacks. - The certification is tied to compliance needs under ETSI TS 119 461 v2.1.1 and the EU’s Anti-Money Laundering Regulation, which becomes mandatory on 10 July 2027. - Identity providers and qualified trust service providers that serve finance, crypto, insurance and gaming face added pressure to certify before the deadline.

What happened: - Veridas said it obtained CEN/TS 18099 Level High, the highest level in the standard’s threat model. - CLR Labs, described as a global pioneer in the standard, audited Veridas and certified its ability to block injection attacks. - Veridas launched its advanced injection-attack detection solution in early 2025. - The company said it is among the first companies worldwide to secure the certification.

The details: - CLR Labs reproduced a real-world fraud environment over several months and attacked the system using multiple injection vectors. - The CEN/TS 18099 methodology tests three threat levels: basic, substantial and high. - Veridas said reaching the top rating confirms protection against the most advanced attacks in the market. - Javier San Agustín, CTO of Veridas, said the certification followed months of work and years of development in injection-attack detection technology. - Alfonso Urrizburu, CRO of Veridas, said the certification strengthens the company’s position under the AMLR framework and supports the technical evidence regulators require, including for web environments. - Veridas said its recent inclusion as a Visionary in Gartner’s Magic Quadrant for the second year in a row supports that positioning.

Between the lines: - The certification race may become a bottleneck because the testing process takes months in a laboratory setting. - Veridas suggested that few providers will be able to complete certification before the AMLR deadline. - Identity verification platforms that are not certified now may struggle to prove compliance in time for Europe’s new anti-money-laundering rules.

What’s next: - Providers serving regulated sectors are likely to accelerate certification efforts ahead of the July 2027 AMLR deadline. - Veridas is likely to use the certification as a sales and compliance signal to financial institutions and other regulated customers. - The market will watch which KYC and identity vendors can secure equivalent certification before the deadline.

The bottom line: - Veridas now has a high-level technical badge for defending against injection attacks, and that could matter as Europe’s AML rules move from planning to enforcement.