Risk-Based Authentication

Risk-based authentication (RBA) adjusts authentication requirements based on signals such as device, location, network, and behavior. Low-risk sessions pass smoothly while risky ones face a step-up challenge such as MFA.

The point is to reduce friction without weakening security: a login from a known device and usual location proceeds, while an unfamiliar device, an impossible-travel pattern, or an anomalous action triggers an additional factor. RBA is the engine behind adaptive authentication and a core building block of conditional access and zero trust. For platforms that implement it, see the top risk-based authentication platforms.

RBA is the mechanism behind most consumer MFA that users tolerate, since the challenge only appears when something looks unusual. The honest limitation is signal quality: residential proxies, real browsers, and stolen sessions all look normal, so a low risk score can mean either a legitimate user or a good attacker. Use it to decide when to demand a strong factor, not whether to have one.

See also: adaptive auth, step-up auth, conditional access, UEBA