Adaptive authentication is a login method that changes verification requirements based on risk signals such as device health, location, IP reputation, sign-in behavior, or impossible travel. A low-risk login may succeed with only a password or single sign-on, while a suspicious attempt can trigger step-up MFA, a block, or a manual review.
This matters because attackers often reuse stolen credentials, automate credential stuffing, or hijack sessions from unfamiliar devices and networks. Adaptive controls help defenders add friction only when the session looks unusual, reducing user burden without lowering security. In practice, these rules appear in identity providers, conditional access policies, and fraud platforms. The main challenge is tuning: weak signals can miss attacks, while overly strict policies can lock out legitimate users.