Risk-based Authentication
Authentication that calculates a risk score per login and dynamically adjusts MFA requirements.
What is Risk-based Authentication?
Risk-based Authentication (RBA) is a dynamic authentication method that calculates a risk score for each login attempt and adjusts authentication requirements accordingly.
Risk score is calculated by evaluating signals:
- Device: Known vs. unknown device (fingerprint)
- Location: Home vs. new country/IP (geolocation)
- Time: Business hours vs. 3AM (temporal)
- Behavior: Typing speed, mouse patterns (biometric)
- Breach indicators: Password in HIBP database
Based on the risk score (0-100):
- Low risk (0-30): Allow login (frictionless)
- Medium risk (31-70): Require MFA (step-up)
- High risk (71-100): Deny or require strong MFA
Analogy
Think of risk-based authentication like a smart security guard. For regular employees during business hours (low risk), they just check the badge. For someone trying to enter at 3AM from an unknown location (high risk), they call for backup and require additional verification.
Types and Use Cases
- CIAM: Reduce friction for trusted consumers, step up MFA for risky logins"
- "Enterprise SSO": Require MFA only for admin roles or sensitive resources"
- "Banking": Always require MFA for wire transfers (high-value)"
- "Zero Trust": Continuously evaluate risk for every access request"
How it Works
{
"riskBasedAuth": {
"signals": {
"device": {"weight": 30, "threshold": "medium"},
"location": {"weight": 25, "threshold": "high"},
"time": {"weight": 15, "threshold": "medium"},
"behavior": {"weight": 20, "threshold": "medium"},
"breach": {"weight": 40, "threshold": "high"}
},
"thresholds": {
"low": 0-30,
"medium": 31-70,
"high": 71-100
},
"actions": {
"low": "allow",
"medium": "requireMFA",
"high": "denyOrStepUpMFA"
},
"mfaMethods": ["totp", "sms", "email"]
}
}Risk-based Authentication vs Static MFA (Always-On)
Risk-based Authentication
Static MFA (Always-On)
Risk-based adjusts based on risk score (dynamic)
Static MFA always requires second factor (static)
Risk-based reduces user friction for trusted logins
Static MFA causes friction for all users
Risk-based requires risk calculation
Static MFA only needs password + second factor
Best Practices for Risk-based Authentication
- "Start with low friction: Only step up MFA for medium/high risk signals"
- "Use device fingerprinting: Recognize trusted devices to reduce friction for returning users"
- "Monitor and tune: Regularly review risk scores and adjust signal weights based on false positives/negatives"
How LoginRadius Powers Risk-based Authentication
LoginRadius CIAM platform provides built-in risk-based authentication with automatic risk scoring based on device fingerprinting, IP geolocation, time patterns, behavioral analysis, and breached password detection. Our platform supports custom risk policies with configurable weights and thresholds, step-up MFA for high-risk logins, trusted device recognition, and detailed risk analytics dashboard. LoginRadius also provides security webhooks to notify your team when high-risk logins are detected.
FAQs
Risk-based authentication (RBA) calculates a numerical risk score (0-100) and maps it to actions (allow/MFA/deny). Adaptive authentication is the broader term that includes RBA plus other adaptive methods. RBA is a specific implementation of adaptive auth using quantitative risk scoring.
Start with these core signals: (1) Device fingerprint (weight: 30) - is this a known device?, (2) IP geolocation (weight: 25) - is this a new country?, (3) Time of day (weight: 15) - is this off-hours?, (4) Breach indicators (weight: 40) - is password in HIBP? Increase weights for high-impact signals.
LoginRadius offers comprehensive risk-based authentication: (1) Risk scoring - automatic evaluation of device, location, time, behavior, breach signals, (2) Step-up MFA - automatically prompt for second factor when risk exceeds threshold, (3) Trusted devices - recognize returning devices to reduce friction, (4) Custom policies - configure risk weights and actions per application/user group, (5) Analytics - detailed risk score reports and false positive tracking.