Cybersecurity glossary
What is Risk-Based Authentication?
Learn what risk-based authentication is, which signals feed risk scores, how challenge decisions are made, and how to tune RBA without locking out legitimate users.
Definition
Risk-based authentication (RBA) is an authentication strategy that estimates the risk of a login or transaction from contextual signals and then allows, challenges, or denies the attempt according to policy thresholds.
Why static authentication policy underfits reality
A login from a managed laptop at headquarters is not the same as a login from a new device on a risky ASN targeting payroll. Risk-based authentication quantifies that difference and chooses controls accordingly.
It is how large identity platforms keep friction tolerable without leaving high-risk paths wide open.
RBA decision loop
Observe context
Collect device, network, behavioral, and resource signals for the attempt.
Score risk
A model or rules engine estimates likelihood of account takeover or abuse.
Apply policy
Allow, step-up MFA, require passkey, limit session, or deny.
Enforce continuously
Re-score on refresh, privilege use, or mid-session anomalies.
Learn from outcomes
Analyst feedback reduces false positives and closes evasion gaps.
Signal categories
Network reputation
Hosting providers, anonymizers, known botnet ranges.
Device trust
Managed posture, new browser, emulator hints.
Geo & velocity
Impossible travel and unusual country changes.
Behavioral baselines
New APIs, bulk downloads, odd hours.
Identity events
Recent recovery, MFA device adds, password resets.
Threat intelligence
Leaked credential hits and active campaign IOCs.
Outcomes by risk band
| Risk band | Example | Typical action |
|---|---|---|
| Low | Known device, usual network | Allow with standard session |
| Medium | New browser at home IP | Challenge MFA / bind device |
| High | Impossible travel to admin app | Require phishing-resistant factor or deny |
| Sensitive transaction | Wire transfer mid-session | Step-up regardless of prior low score |
Tuning checklist
- Define explicit allow/challenge/deny thresholds per application sensitivity.
- Prefer phishing-resistant challenges when risk is high.
- Re-evaluate risk during the session—not only at initial login.
- Track false-positive rates and give support clear playbooks.
- Avoid relying solely on SMS OTP as the high-risk challenge.
- Protect against attackers who slowly train ‘normal’ baselines.
- Log risk reasons for investigators without exposing secrets.
- Combine RBA with breached-password detection and bot controls.
The practical takeaway
Risk-based authentication turns context into an access decision. It reduces unnecessary friction and intensifies verification when signals look wrong.
Treat it as policy plus strong authenticators plus continuous feedback—not as a mysterious score that occasionally skips MFA for whoever seems familiar.
Related security terms
Adaptive Authentication
Closely related approach emphasizing dynamic challenge selection.
Step-Up Authentication
Stronger verification triggered by risk or sensitive actions.
Multi-Factor Authentication (MFA)
Common challenge invoked when risk exceeds thresholds.
Account Enumeration
Attack pattern RBA telemetry may help detect at scale.
Phishing-Resistant MFA
Preferred challenge type when RBA demands higher assurance.
Frequently asked questions
What is risk-based authentication in simple terms?
The system looks at clues—new device, odd location, strange behavior—and decides whether to let you in, ask for MFA, or block the attempt.
Is RBA the same as adaptive authentication?
They are often used interchangeably. RBA emphasizes scoring risk; adaptive authentication emphasizes changing controls based on that score.
What signals are typically used?
IP reputation, geolocation, device fingerprint/posture, travel velocity, time-of-day, threat intel, historical user behavior, and resource sensitivity.
Can RBA replace MFA?
No. It decides when MFA or stronger authenticators are required. Privileged access should still default to strong MFA.
What are false positives and false negatives?
False positives challenge or block good users. False negatives allow attackers who blend into ‘normal’ patterns. Tuning and feedback loops are essential.
Should users see why they were challenged?
Give operators detailed reasons. For end users, provide actionable support paths without revealing scoring rules that aid evasion.
How does RBA support zero trust?
It continuously evaluates context rather than trusting a single successful login for long periods.
References
Explore authoritative guidance and frameworks related to risk-based authentication.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.