I don't think SSO is enough.

SSO is great for proving someone has access to the right account. But what happens when you need to prove the actual person behind that account is who they say they are? With stolen sessions and compromised devices becoming a bigger issue I feel like there’s still a gap here. What are you guys using for human verification that also counts as a good security tool?