Not every sign-in carries the same risk, so why should every user go through the same authentication experience?
A trusted employee signing in from a familiar device and location shouldn't face the same authentication requirements as someone accessing an account from an unfamiliar device halfway around the world. Yet traditional authentication policies often apply the same password and MFA requirements regardless of the risk involved, creating unnecessary friction for legitimate users.
SecureAuth's risk engine takes a smarter approach. It evaluates each sign-in using a Level of Assurance (LOA) score to determine how much authentication is needed. When the risk is low and confidence is high, users can skip the MFA challenge altogether. That's frictionless authentication in action.
SecureAuth AI-driven risk engine
The risk engine dynamically adjusts the authentication experience. Every login is scored in real time, and friction only shows up when the risk is there:
- It correlates signals. Device, IP address, geolocation and behavior are weighed together at every sign-in.
- It calculates a Level of Assurance (LOA) score on a scale from 0 to 100.
- A higher LOA score means lower risk. It measures how confident SecureAuth is that the person signing in is who they claim to be.
- It adjusts the experience to match. The score decides whether a sign-in needs a password, an MFA prompt, or a stronger method.
- Device
- IP address
- Geolocation
- Behavior
- High LOAFrictionless and passwordless
- Medium LOAStandard MFA
- Low LOAPhishing-resistant step-up
And the results speak for themselves. One of the largest US healthcare companies was able to eliminate MFA challenges for approximately 85% of returning logins, reducing unnecessary friction while maintaining risk-based security.
With SecureAuth Release 26.4, the Same Score Does More
Passwordless for trusted sessions
LOA is a condition in SecureAuth's Conditional Password Suppression rules, alongside the existing Device Recognition, Group, Multi-factor Methods and User conditions. Based on the LOA score the risk engine returns and the condition you set, SecureAuth skips the password step for that sign-in.
What that means for users:
- On a known device, in a normal location, behaving as usual, they skip the password and get straight to work.
- When anything doesn't fit the pattern, they get the full challenge, password included.
- Every sign-in is scored fresh. A trusted user who suddenly shows up on an unfamiliar device is asked for their password again.
That's what "passwordless on top of frictionless" means: the same score that lets a trusted user skip the MFA prompt now lets them skip the password too. For the wider picture of removing passwords across your workforce, see passwordless authentication for the workforce.
- Enter username
- Password skipped
- One push approval, or no prompt at all
- Enter username
- Password required
- FIDO2 security key or passkey only
The right MFA method for the risk
Two thresholds split the LOA score into low, medium and high tiers, and your policy decides what each tier asks of the user.
A Seamless Sign-In Experience Without Compromising Security
The problem the industry is still solving
- Passwords are still the easiest way in. Credential abuse was the most common way attackers got in, at 22% of breaches, according to the Verizon 2025 Data Breach Investigations Report.
- Blanket MFA wears users down. When every sign-in brings a prompt, people learn to approve without reading. Attackers exploit that with MFA fatigue, also called push bombing or prompt bombing: they flood a user with prompts until one gets approved, a technique CISA warns about.
- Static rules can't tell good sign-ins from bad ones. A rule that challenges everyone treats an employee on their own laptop the same as a bot on a rented server. It costs time and money, and tells you nothing.
- Friction has a price. Every unnecessary prompt or password reset means a slower start to the day, a help desk ticket, or, for consumer apps, an SMS bill and an abandoned sign-in.
How it improves the user experience
- No password for trusted users. People signing in from their usual device and location go straight in.
- Fewer prompts. MFA only appears when the score says it's needed.
- One policy for every risk level. Apply a single authentication policy that dynamically offers the appropriate MFA methods based on risk, eliminating the need to create separate applications or policies for different user groups.
Stronger Security Without Added Friction
- Stronger protection when it matters most. Higher-risk sign-ins can require stronger, phishing-resistant authentication methods, while lower-risk users enjoy a simpler sign-in experience.
- Make every MFA challenge count. Fewer unnecessary prompts mean less MFA fatigue. When users are challenged, they're more likely to pay attention and recognize unusual authentication requests.
- Continuous risk evaluation, not permanent trust. Every sign-in is evaluated independently. Even a previously trusted user may be challenged when their device, location, or behavior changes.
Unlock the Benefits of Risk-Based Authentication
The risk engine works from the first day. Device fingerprinting and the IP, geolocation and geo-velocity checks need no training period. After a user's first successful sign-in, the engine knows their device, network and location, and from the second sign-in it can usually carry them through with little friction.
That makes the order of your policy rules important:
- Turn the risk engine on in active mode. A long silent or listening phase doesn't train the models faster. Scores improve from real sign-ins where users actually authenticate.
- Put the LOA rule first in the policy. If network, VPN or group bypass rules come first, they win every evaluation, most users never reach the LOA check, and the engine has nothing to act on.
- Review your bypass rules. A broad rule such as "skip MFA on the corporate network" ignores device and behavior signals. Fewer bypass rules with LOA on top is both safer and easier to maintain.
- For configuration details, see Use LOA for password suppression in the LOA provider settings guide.
- For everything in this release, see the release 26.4 release notes.
FAQ
What is risk-based authentication?
Risk-based authentication checks how risky each sign-in is before deciding what to ask the user for. Instead of applying the same password and MFA requirements to everyone, it weighs signals such as the device, IP address, location and behavior, and asks for more only when the sign-in looks risky. Trusted sign-ins get through with less friction, and unusual ones get a stronger challenge.
What is a Level of Assurance (LOA) score?
The LOA score is a number from 0 to 100 that SecureAuth's AI-driven risk engine calculates for every sign-in. It measures how confident SecureAuth is that the person signing in is who they claim to be, so a higher score means lower risk. Two thresholds split the score into low, medium and high tiers, and your policy decides what each tier asks of the user.
Which platforms support real-time risk scoring at login?
SecureAuth's risk engine scores every sign-in in real time. It weighs device, IP address, geolocation and behavior signals together and returns an LOA score, which your policy uses to decide whether a sign-in needs a password, an MFA prompt or a stronger method.
What's the difference between frictionless and passwordless authentication?
Frictionless authentication skips the MFA challenge when the risk is low, so a trusted user isn't asked for a second factor. Passwordless authentication skips the password step. With SecureAuth release 26.4, the same LOA score can do both: the score that lets a trusted user skip the MFA prompt now lets them skip the password too.
Passwordless vs MFA: do you have to choose?
No. Passwordless removes the password step, and MFA adds a second factor. They work together: a trusted sign-in can skip the password, while a risky sign-in is asked for the password and a phishing-resistant method such as a FIDO2 security key or passkey.
How do you deploy passwordless access without slowing employees down?
Let risk decide when the password is needed. In the policy's Login Workflow tab, turn on Allow password suppression and add a Conditional Password rule on the confidence level, for example asking for the password only when the confidence level is Low or Medium. Employees on their usual device, network and location skip the password, and only unusual sign-ins get the full challenge.
Is skipping the password less secure?
No. SecureAuth skips the password only when the LOA score satisfies the condition you set, which means the device, network, location and behavior match the user's normal pattern. Every sign-in is scored fresh, so the same user on an unfamiliar device is asked for their password again, and risky sign-ins can be held to phishing-resistant methods.
What is adaptive MFA?
Adaptive MFA changes which MFA methods a sign-in is offered based on its risk. In SecureAuth, the LOA score decides: a low-risk sign-in can get a simple push, and a high-risk one can be limited to phishing-resistant methods only. One policy covers every risk level, so you don't need separate applications or policies for different user groups.
How long does the risk engine take to start working?
It works from the first day. Device fingerprinting and the IP, geolocation and geo-velocity checks need no training period. Each user typically sees one MFA prompt on their first sign-in after you turn the risk engine on, and from the second sign-in the LOA score can usually carry them through with little friction. Put the LOA rule first in your policy so network, VPN or group bypass rules don't take precedence.