Adaptive Authentication.

An authentication approach that adjusts the strength and number of factors required in real time based on signals such as device, location, and behavior. It belongs to the Identity & Access category of cybersecurity.

An authentication approach that adjusts the strength and number of factors required in real time based on signals such as device, location, and behavior.

Adaptive authentication evaluates contextual signals at sign-in and during a session to vary the credentials required from a user. Inputs typically include device posture, IP reputation, geolocation, network type, time of day, prior behavior, and threat-intelligence feeds. NIST SP 800-63C describes how relying parties can combine assurance levels with such signals, and products from Microsoft Entra Conditional Access, Okta, Ping Identity, and Cisco Duo implement the pattern with policy engines and risk scoring. A low-risk login from a managed device on the home network may pass with a passkey; a higher risk score (new device, anonymizing proxy, unusual time) escalates to MFA, blocks, or quarantine. Adaptive authentication is foundational to zero-trust access strategies.

Defences for Adaptive Authentication typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Adaptive access, Context-aware authentication.