Adaptive Authentication

What is adaptive authentication?

Adaptive authentication, also called risk-based authentication, is an access control method that changes what a user must prove depending on the risk of each sign-in attempt. A login from a managed laptop on a known network passes with a single factor, while the same account from a new country on an unmanaged device is challenged or blocked.

How adaptive authentication works

• The identity provider collects signals at each attempt: device compliance, IP reputation, geolocation, time of day, and behavioral patterns.
• A risk score is calculated, often with models trained on the organization past sign-ins.
• Policy maps that score to an outcome: allow, step up to a second factor, or block.
• Impossible travel, a leaked credential match, or an unrecognized device typically triggers a step-up.
• Every decision is logged, which is what makes the control auditable.

Where adaptive authentication has no visibility

The engine only sees what passes through it. An application with a local password, a personal account used for work, or an OAuth grant approved directly in a browser produces no signal and receives no policy. This is the recurring pattern in mid-market estates: strong adaptive policies on 20 federated applications, and none at all on the 80 that were never connected.

Examples and use cases

A company sets Conditional Access to require a second factor for any sign-in outside its two office countries. Two months later a finance manager's credentials leak, the attacker attempt from another region is challenged, and it fails. In the same month an unrelated invoicing tool with its own login is compromised without producing a single signal, because it was never behind the identity provider. Both outcomes trace back to coverage rather than policy quality, which is the gap Corma closes by governing the applications the identity provider does not see.

Related concepts

• Identity and access management platform
• Automated identity governance and administration
• IAM for security teams

FAQ

What is the difference between adaptive authentication and MFA?

MFA always requires the same additional factor. Adaptive authentication decides, attempt by attempt, whether that factor is needed based on live risk signals.

Which risk signals are most useful?

Device compliance and known versus unknown device carry the most weight in practice, followed by impossible travel and leaked credential detection. Geolocation alone produces many false positives for traveling staff.

Does adaptive authentication reduce friction?

Yes, that is its main appeal. Trusted contexts pass without a challenge, so the second factor is spent where it actually changes the outcome.

Is adaptive authentication required by NIS2?

NIS2 lists multi-factor or continuous authentication solutions among its baseline risk management measures in Article 21(2)(j). Adaptive authentication is one recognized way to meet that expectation, not an explicit legal requirement in itself.

Request a demo