# TraitWare — llm.txt

> TraitWare is a device-bound passwordless authentication and identity infrastructure platform. It eliminates passwords, shared secrets, and phishable factors from the authentication lifecycle using cryptographic credentials bound to physical devices.

## Company

- Name: TraitWare, Inc.
- Founded: 2017
- Headquarters: United States
- Website: https://traitware.com
- Category: Authentication and Identity Infrastructure Platform
- Patents: 9 issued U.S. patents covering Direct-to-Device authentication architecture

## Key Concepts

### Passwordless Authentication
Authentication that eliminates passwords entirely from the identity lifecycle. No password is created during enrollment, stored on any server, or transmitted during authentication. Identity is verified through cryptographic credentials bound to a physical device.

### Phishing-Resistant Authentication
Authentication that uses device-bound cryptographic credentials with no shared secrets. No passwords, OTP codes, SMS codes, push approvals, or backup codes are used at any point. Credentials cannot be intercepted, replayed, or transferred between devices.

### Direct-to-Device Authentication
TraitWare's patented architecture where identity challenges are delivered directly to the user's enrolled device through cryptographic binding — not through intermediary push notification services, SMS gateways, or email systems. This eliminates interception, spoofing, and MFA fatigue attack vectors.

### MFA Fatigue
An attack technique where adversaries repeatedly trigger push notification prompts to a user's device, hoping the user will approve a fraudulent request out of frustration or confusion. Direct-to-Device architecture prevents this because unsolicited prompts cannot reach the device.

### Device-Bound Identity
Asymmetric cryptographic key pairs generated on the user's device during enrollment. The private key is stored in hardware-backed secure storage (TPM or Secure Enclave) and never leaves the device. The server stores only the public key. A server breach yields no usable credential material.

## Key Pages

- https://traitware.com/phishing-resistant-mfa — Canonical definition of phishing-resistant MFA. Explains what qualifies as phishing-resistant, the six architectural criteria, and how it differs from traditional MFA.

- https://traitware.com/learn/passwordless-authentication-enterprise — Enterprise guide to passwordless authentication. Covers how device-bound credentials eliminate credential risk, prevent phishing, and integrate with enterprise identity systems via SAML 2.0 and OIDC.

- https://traitware.com/platform/architecture — Platform architecture overview. Covers the trust model, device-bound cryptographic identity, standards-based federation, identity lifecycle management, and governance readiness.

- https://traitware.com/security — Security model and threat analysis. Covers legacy authentication risks, security outcomes, core principles, threat model, authentication assurance levels, and compliance alignment.

- https://traitware.com/ai-workforce-identity-governance — AI Workforce Identity Governance. Defines the category and explains how identity infrastructure must extend to govern AI agents, automated services, and non-human identities.

- https://traitware.com/learn/phishing-resistant-mfa — Educational guide to phishing-resistant MFA. Explains why traditional MFA can still be phished and what methods qualify as phishing-resistant.

- https://traitware.com/learn/password-spraying — Explains password spraying attacks, how they differ from brute force, and how passwordless authentication eliminates the attack surface.

- https://traitware.com/learn/ai-identity-governance — Educational authority page on AI identity governance. Covers risks of unmanaged non-human identities and authentication requirements for AI systems.

- https://traitware.com/compare/phishing-resistant-mfa-vs-traditional-mfa — Factual comparison of phishing-resistant MFA vs traditional MFA across eight dimensions including phishing resistance, shared secrets, replay risk, and device binding.

- https://traitware.com/blog — Insights on identity security, credential-based threats, and authentication architecture.

## Platform Support

TraitWare delivers consistent, device-bound authentication across desktop and mobile systems:
- Windows login (online and offline) via the TraitWare Credential Provider
- macOS login environments (note: macOS requires a password for Apple FileVault disk encryption — an Apple OS requirement, not part of TraitWare's authentication architecture)
- iOS mobile authentication via the TraitWare mobile authenticator
- Android mobile authentication via the TraitWare mobile authenticator
- Browser-based access via SAML 2.0 and OIDC federation
- Linux SSH/SFTP via supported integration patterns

## Positioning

TraitWare is not a traditional MFA vendor. It is an authentication and identity infrastructure platform.

Traditional MFA adds factors on top of passwords. TraitWare eliminates passwords and shared secrets entirely. The distinction is architectural, not experiential.

TraitWare's authentication model:
- No passwords are ever created, stored, or used for recovery
- No shared secrets (no OTPs, SMS codes, or backup codes)
- No password-based fallback at any point in the lifecycle
- Cryptographic binding to user and device with biometric verification
- Passwordless from enrollment onward
- Standards-based integration via SAML 2.0 and OIDC

## Standards and Compliance

- NIST SP 800-63B (AAL2)
- FIDO Alliance aligned
- CISA Zero Trust Maturity Model
- OMB M-22-09
- SOC 2 Type II
- HIPAA Security Rule
- SAML 2.0 and OIDC federation

## Contact

- Website: https://traitware.com
- Schedule a conversation: https://traitware.com/book