Adaptive Authentication

Overview

Adaptive Authentication is an authentication approach that changes verification requirements according to contextual and behavioral risk signals observed before or during access. The control exists to ensure that only appropriately identified and authorized principals can access resources or approve actions at the required level of assurance. It differs from fixed multi-factor authentication because the challenge, assurance level, or access decision can vary with device, location, transaction, session, and anomaly indicators. It should be interpreted alongside Authentication Failures because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow establishes a trusted identity or service principal, binds authenticators, evaluates context, applies policy, and records the resulting access decision. Authorization must be enforced by the server or resource boundary on every relevant request and should not depend on hidden interface elements or untrusted client claims. In this context, a safe design uses explainable signals, resistant authenticators for high-risk actions, anti-bypass testing, privacy controls, fallback recovery, false-positive monitoring, and protection against attacker-controlled context.

It should connect the term to Phishing where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should capture principal, authenticator or credential type, assurance level, resource, action, policy version, contextual signals, decision, failures, recovery, grants, revocations, and administrative changes. Sensitive secrets and authentication content should not be copied unnecessarily into logs.

Useful measures include enrollment and recovery success, challenge rate, failure rate, unauthorized attempts, privilege age, dormant access, review completion, false rejection, compromise events, and time to revoke access.

The relationship with Access Control List (ACL) should be documented where it affects residual risk or control ownership.