Risk-Based Authentication (RBA).

An authentication strategy that computes a real-time risk score for each sign-in and varies the response — allow, challenge, or block — based on that score. It belongs to the Identity & Access category of cybersecurity.

An authentication strategy that computes a real-time risk score for each sign-in and varies the response — allow, challenge, or block — based on that score.

Risk-based authentication scores every authentication attempt using contextual signals: device fingerprint, IP reputation, ASN, geolocation, time of day, prior user behavior, threat intelligence, and known leaked credentials. Low-risk attempts pass with a passkey or password; medium-risk attempts trigger MFA or step-up; high-risk attempts are blocked or quarantined. Microsoft Entra ID Protection, Okta ThreatInsight, Ping Risk Engine, IBM Trusteer Pinpoint, and Auth0 Adaptive MFA all implement RBA. NIST SP 800-63B endorses risk-driven choice of authenticators, and academic work since Williamson's 'Enhanced Authentication in Online Banking' (2007) has established the discipline. Effective RBA pairs supervised models with explainable rules so that auditors and operations teams can investigate every decision.

Defences for Risk-Based Authentication (RBA) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: RBA, Risk-aware authentication.