Home / Knowledge hub / Adaptive authentication
Knowledge hub
Adaptive authentication
Asking for more proof when a sign-in looks unusual.
What it means
Adaptive authentication, also called risk-based authentication, decides how much proof to ask for at each sign-in. A familiar device on a usual network might need only a password or passkey. An unfamiliar device, a new country or odd behaviour triggers a second factor, or a block.
The decision comes from signals gathered at the time: the device, the network, the location, the time of day, how fast the details were typed, and whether the account has been under attack recently.
Why it matters
It lets you protect accounts without making every sign-in painful. Most people sign in from the same place most days, and extra friction is saved for the cases that deserve it. That is a useful balance for consumer products with low tolerance for friction.
It also catches attacks that a password alone cannot. A stolen password used from a new device meets a second challenge instead of a welcome screen, which blunts credential stuffing and some account takeovers.
How it shows up
You meet it in identity providers, fraud tools and the sign-in screens of banks and large consumer products. Typical outcomes are allow, step up to another factor, or deny and alert. The same logic can run again before sensitive actions.
The mistakes repeat. Signals are easy to fake or copy. Only the first step is risk-checked, and the recovery path skips it. Step-up is a text message that can be taken over by SIM swap. Rules are too loose to notice anything. Check what triggers a challenge and whether every route goes through it.
Questions people ask
Adaptive authentication, answered
Is adaptive authentication the same as MFA?
No. MFA always asks for more than one factor. Adaptive authentication chooses when to ask. It often uses MFA as the step-up.
The two work best together.
What signals does it use?
Common ones are the device, the IP address and network, approximate location, time, past behaviour and known bad addresses. Impossible travel is one example.
No single signal is reliable, so they are combined.
Can attackers get around it?
Yes. They can use a proxy near the victim, a copied browser profile or a stolen session. That is why risk checks should supplement strong factors, not replace them.
Phishing-resistant methods such as passkeys help more.
Does it replace login protections like rate limits?
No. Rate limits, lockout and monitoring stay in place. Adaptive checks decide how hard to challenge, while those controls limit how fast an attacker can try.
Use them together.
How do we test it?
Sign in from a new device, a different region and through an automated client, and see whether the challenge fires each time. Then test recovery, API and mobile routes for the same rules.
Gaps are usually in the paths nobody thought of.
Sources
Where this comes from
Related
Terms that sit next to this one
MFA
A second proof beyond the password, usually a code or a hardware key.
Impossible travel
Two sign-ins from places too far apart for one person to have reached.
Passkeys
Phishing-resistant sign-in using a key on your device instead of a password.
Browser fingerprinting
Identifying a visitor from the many small details their browser reveals.
Account takeover
An attacker ends up signed in as one of your real users.
What makes a sign-in look odd?
We test sign-in and recovery paths for takeover flaws and prove each by exploiting it. We report only what we actually broke. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.