Adaptive Authentication

Identity and Access Management has evolved over two decades to raise security while reducing friction in user experience, leading to the growth of Adaptive Authentication (AA). AA collects additional attributes about users and their environments and evaluates them against risk-based policies to apply the appropriate assurance level for access to sensitive resources. It commonly uses “step-up” authentication with authenticators ranging from OTPs (phone/email/SMS), mobile push, native mobile biometrics, FIDO U2F/UAF, hardware tokens, SmartCards, and behavioral biometrics. Behavioral biometrics can enable continuous authentication by comparing ongoing behavior (keystrokes, swipes, gyroscope patterns) to established baselines.

AA can be policy/context-based (static rules using factors like time, user category, location, or device) and/or dynamic (risk-scoring analytics that identify anomalies). Stronger products blend both approaches, since each has limitations and different use cases. AA is illustrated via a financial app that checks IP, geo-location, and device ID after password login; a new device triggers an approval email, and a high-value transaction triggers an in-app push confirmation. AA can be viewed as an authorization approach and even as a form of attribute-based access control due to its reliance on evaluated attributes and business rules.

The market is mature yet rapidly evolving, with near-ubiquitous baseline authenticators and differentiation shifting to advanced methods, analytics, threat intelligence integration, and management. Required capabilities include multi-authenticator support, IAM integration, real-time behavioral/environmental risk analysis, federation (OAuth2, OIDC, SAML), regulatory support (GDPR, PSD2), dashboards, delegated administration, and threat intelligence subscriptions. Vendor selection should prioritize fit, integration with existing IAM, and validation via detailed analysis and proof of concept, noting that breaches remain possible even with strong defenses.

• Adaptive Authentication evaluates additional user and environmental attributes against risk-based policies to determine assurance levels.
• Step-up authenticators include OTPs, mobile push, mobile biometrics, FIDO U2F/UAF transactions, hardware tokens, SmartCards, and behavioral biometrics.
• Behavioral biometrics commonly uses keystroke analysis, mobile swipe analysis, and mobile gyroscopic analysis.
• Dynamic AA baselines regular access patterns and triggers additional challenges when anomalous behavior is detected.
• SMS OTP is deprecated by some organizations such as US NIST as a primary or step-up method due to known weaknesses.
• Adaptive Authentication is used in healthcare, insurance, travel, aerospace, defense, government, manufacturing, and retail.
• Many organizations use AA with Physical Access Control Systems to open doors and gates.
• This Leadership Compass evaluates solutions available primarily for on-premises deployment.
• Overall leaders listed are CA Technologies, ForgeRock, IBM, RSA, and SecureAuth.
• RSA Adaptive Authentication is described as supporting over one billion end users.

• “Adaptive Authentication (AA) is the process of gathering additional attributes about users and their environments and evaluating the attributes in the context of risk-based policies.”
• “The goal of AA is to provide the appropriate risk-mitigating assurance levels for access to sensitive resources by requiring users to further demonstrate that they are who they say they are.”
• “Behavioral biometrics can provide a framework for continuous authentication, by constantly evaluating user behavior to a baseline set of patterns.”
• “A more advanced form of AA uses risk-scoring analytics algorithms to first baseline regular access patterns and then be able to identify anomalous behaviour which triggers additional authentication challenges.”
• “Adaptive authentication, then, can be considered a form of authorization.”
• “Since access to applications and data are the goal, adaptive authentication can even be construed as a form of attribute-based access control (ABAC).”
• “This is invariably a positive feature, as there are use cases where the use of either static or dynamic AA proves the most appropriate, and both approaches are not without their limitations.”
• “Picking solutions always requires a thorough analysis of customer requirements and a comparison with product features.”
• “The advantages gained from the imagined greater ease of integrating disparate products from the same vendor rarely offer the reduced complexity promised by sales.”
• “Even the best defensive systems can suffer breaches.”