# Adaptive Authentication A method of authentication that adjusts the required verification steps based on a real-time assessment of risk. It analyzes contextual factors like user location, device, and behavior to determine the appropriate level of security, balancing user convenience with robust protection. **Pronunciation:** uh-dap-tiv aw-then-ti-kay-shun **Difficulty:** Intermediate **Synonyms:** Risk-Based Authentication (RBA), Context-Aware Authentication, Step-Up Authentication **Categories:** Cybersecurity, Identity and Access Management (IAM) **Tags:** Security, Authentication, Identity and Access Management, Cybersecurity, Risk-Based Authentication, MFA Canonical: https://scaleengineer.com/glossaries/adaptive-authentication --- ## Definitions - **Core Concept in Cybersecurity:** **Adaptive Authentication** is a dynamic and intelligent method for verifying a user's identity. Unlike static authentication policies that treat every login attempt the same, it assesses the risk associated with each access request in real-time and adjusts the authentication requirements accordingly. This process, often called **Risk-Based Authentication (RBA)**, works by collecting and analyzing various contextual signals to calculate a risk score. Key signals include: * **Device Information:** Is the device managed by the company? Is it a new or recognized device? * **Location Data:** Is the user logging in from a typical location or a new country? * **Network Information:** Is the user on a secure corporate network or an open public Wi-Fi? * **User Behavior:** Does the access time and pattern match the user's historical behavior? Based on the calculated risk score, the system takes an appropriate action: * **Low Risk:** The user is granted access seamlessly, often with just a password or via Single Sign-On (SSO). * **Medium Risk:** The system initiates **Step-Up Authentication**, requiring an additional verification factor, such as an MFA code, a push notification, or a biometric scan. * **High Risk:** The system can block the access attempt entirely and alert security teams. By tailoring the security response to the specific context of each login, **Adaptive Authentication** effectively strengthens security against real threats while minimizing friction for legitimate users, making it a cornerstone of modern Identity and Access Management (IAM) and Zero Trust security models. ## Etymology The term combines 'Adaptive,' meaning the ability to change or adjust to new conditions, with 'Authentication,' the process of verifying a user's identity. It literally means an authentication process that adapts to the situation. ## First used Late 2000s ## Historical context The concept of authentication began with simple, static methods like username and password combinations. As cyber threats grew, Multi-Factor Authentication (MFA) was introduced to add another layer of security. However, requiring MFA for every login created friction for users, leading to frustration and reduced productivity. The need for a more intelligent and dynamic approach gave rise to **Adaptive Authentication** in the late 2000s and early 2010s. This evolution was driven by the proliferation of cloud services, mobile computing, and remote work, which dissolved the traditional network perimeter. Instead of a one-size-fits-all security policy, **Risk-Based Authentication (RBA)** emerged as the core engine for adaptive systems. These systems could analyze a rich set of contextual data to make smarter, real-time decisions about user identity, paving the way for modern security frameworks like Zero Trust. ## Q&A - **What is the primary goal of Adaptive Authentication?:** The primary goal of Adaptive Authentication is to create a balance between strong security and a positive user experience. It achieves this by applying stringent authentication challenges, like MFA, only when a login attempt is deemed high-risk. For low-risk, legitimate user activities, it provides a frictionless, seamless access experience, avoiding unnecessary security hurdles. - **What are some common risk factors evaluated by an Adaptive Authentication system?:** An Adaptive Authentication system evaluates several contextual risk factors, including: * **Geolocation:** Where is the user logging in from? * **IP Address:** Is the IP address known, new, or associated with malicious activity? * **Device Fingerprint:** Is the user on a recognized and trusted device? * **Time of Access:** Is the login attempt occurring at a typical time for this user? * **User Behavior:** Does the login attempt deviate from the user's established patterns? ## Usage examples - In response to sophisticated phishing attacks, our company implemented **Adaptive Authentication** to dynamically challenge suspicious login attempts with additional verification. - The online banking platform uses **Risk-Based Authentication**; if you log in from a new device, it triggers a **Step-Up Authentication** and asks for a code sent to your phone. - **Adaptive Authentication** provides a better user experience by not forcing MFA on every single login, making it a form of **Context-Aware Authentication** that understands when security needs to be heightened. ## Related terms - Multi-Factor Authentication (MFA) - Single Sign-On (SSO) - Zero Trust Security - Biometric Authentication - Identity Provider (IdP) - Behavioral Biometrics ## Popular related terms - Multi-Factor Authentication (MFA) - Zero Trust Security - Single Sign-On (SSO)