What is adaptive or risk-based MFA?

Adaptive or risk-based MFA adjusts authentication requirements dynamically based on contextual signals rather than applying the exact same verification steps to every login attempt regardless of circumstances.

Signals commonly used to assess risk:

• Location: Whether the login originates from a recognized geographic area or network.
• Device: Whether the device has been used successfully before and matches a known fingerprint.
• Behavior pattern: Typing rhythm, navigation habits, or typical login times associated with the user.
• Network reputation: Whether the connection originates from an IP address or network with a history of suspicious activity.

A login from a recognized device and location might require only a single additional factor, while a login from an unfamiliar location or an unrecognized device triggers additional verification steps. This balances security with user convenience by concentrating friction where the actual risk of a given login attempt is highest.