FastPass IVM Technical Architecture: Cloud & On-Premises Deployment

FastPass IVM is available in three deployment models. The on-premises model is installed within your own data center, runs entirely inside your network perimeter, and is recommended for organisations with strict data-residency requirements. The FastPass Cloud model is hosted by FastPassCorp on SOC 2-aligned, Cyber Essentials Plus-certified infrastructure and includes automatic updates with no infrastructure to manage. The multi-tenant cloud model is designed for Managed Service Providers who need to support multiple client organisations from a single instance with full client separation. Both the on-premises and cloud editions support the same range of ITSM platforms, MFA providers, and back-end systems.

FastPass IVM can be configured to detect and act on virtually any data point it has access to — from Active Directory attributes and ITSM history to MFA provider logs and HR system data. Rather than relying solely on what a caller says, IVM continuously evaluates the context surrounding the request to surface risk before the agent makes any decision.

Help desk activity signals

IVM can detect one or more failed identity verification attempts within a configurable window — whether the past hour, day, or week — with escalating alert levels at each threshold. It can also flag an unusually high volume of calls from a single user in a short period, or surface the fact that a previous call from this user was escalated or marked suspicious.

Authentication and credential signals

IVM can detect recent bad password attempts, a recently locked or unlocked account, a password changed recently without a corresponding self-service action, an MFA device last seen in an unexpected location or country, and an MFA device location that does not match the user's established pattern.

Device and access signals

IVM can check whether the call is associated with the user's registered PC or known device, whether the last login came from an unfamiliar device or IP range, whether the account has been dormant for an unusual period, and whether the call timing is inconsistent with the user's normal working pattern.

Each signal can be configured to add a warning visible only to the agent, deduct points from the verification score requiring stricter proof to compensate, or trigger a mandatory escalation. Signals can be combined so that a single anomaly generates a soft warning while two or more occurring together automatically escalate the call. This layered approach means that even a caller who has memorised all the right answers will struggle to pass if the surrounding signals do not add up.

FastPass IVM supports several integration methods for pulling data from HR and back-office systems: direct Active Directory integration, direct database table access, and API integrations using JSON and REST formats. All imported data is stored in encrypted form within FastPass. This data can then be used as a verification factor — for example, presenting a partial value from an HR record and asking the caller to confirm it, without exposing the full value to the agent.

Yes. FastPass IVM accommodates AD multi-forest environments and supports an effectively unlimited number of Active Directory forests and AD connections.

Yes. FastPass fully supports hybrid architectures, enabling seamless user verification across on-premises Active Directory, Microsoft Entra ID formerly known as Azure AD, and mixed environments where both coexist. FastPass can even set passwords on both systems at the same time for user convenience.

FastPass requires the following delegated rights for its privileged Active Directory account: Reset Password for password management operations, Write permissions on the LockOutTime and PwdLastSet attributes for account management, and Read-only access to specific fields for general operational use. For Entra ID, an Enterprise Application must be created to grant FastPass access only to the required data fields. Full permission delegation documentation is available from the FastPass support team.

Yes. FastPass can integrate with RADIUS-based authentication solutions to provide flexible and secure verification options for environments that rely on RADIUS infrastructure such as RSA or Gemalto Safenet amongst others.

Yes. FastPass IVM supports Time-based One-Time Password solutions compliant with RFC 6238, allowing users to authenticate using standard authenticator apps such as Google Authenticator for secure multi-factor verification.

Yes. FastPass IVM supports SAML-based SSO integrations including Azure Entra, allowing agents to authenticate with their existing SSO environment when accessing the FastPass tool. The integration is based on standard SAML protocols and is compatible with most SAML-compliant identity providers.

Yes. FastPass IVM's scoring engine is highly configurable. Score values can be set globally or varied by user group, user type, or the type of operation being performed. Individual verification checks can be marked as mandatory so they must pass regardless of total score. The default profile includes 28 scenarios all of which are customisable. This allows fine-grained tuning across different populations — for example, applying a stricter threshold for privileged users, IT administrators, or sensitive departments such as Finance and HR.

FastPass IVM uses a lightweight agent installed on the user’s device. This agent communicates with the FastPass server and reports the device the user is currently using.

When a help desk interaction occurs, FastPass can prompt the end user to activate the agent on their computer—even if they are not logged in. The system then verifies whether the request is coming from the user’s recognized device and flags any mismatch as potentially anomalous.

This dynamic device-matching capability adds an additional layer of security and helps protect against social engineering attempts.

Yes. FastPass IVM can be configured to send notifications to security teams, supervisors, end users, or external systems via JSON/REST when unusual patterns are detected.

For example, the system can trigger alerts if a user account generates multiple failed verification attempts within a short period. These events can also contribute to a dynamic risk score or be handled differently based on user groups, enabling more granular and adaptive security responses.

This approach supports proactive fraud detection while reducing the need for manual log analysis.

FastPass releases approx. one major version upgrade per year, with two to three additional minor updates focusing on new features and bug fixes. The Windows Client, Password Interceptor, and Filter components are backward compatible with the two most recent major versions, providing flexibility during upgrade cycles.

FastPass supports the current major release and the immediately preceding major release. If a customer encounters issues on the previous major version, the support team will assist including providing fixes to facilitate upgrades. Support is not provided for versions two major releases behind the current one. FastPassCorp recommends upgrading at least once per year in line with the major release cycle.

Yes. FastPass IVM operates independently of FastPass Self-Service Password Reset. However, some verification methods — particularly those that rely on enrollment data collected during SSPR — are only available when both products are in use. FastPassCorp recommends the combined solution: IVM addresses the help desk security gap while SSPR delivers the self-service efficiency gain, and together they produce a strong combined business case.

Yes. FastPass features a detailed audit log that records every action taken within the system — including user interactions, verification steps, outcomes, and all operations performed within the IVM tool and the admin interface. This provides a complete and tamper-evident record for security oversight, incident investigation, and compliance reporting.