Authentication control is any mechanism that verifies a user, system, or service before allowing access to an account, application, API, or administrative function. It can include passwords, multi-factor authentication, session checks, device trust, service tokens, and login policies that limit when and how access is granted.
In cyber security, authentication controls are a first line of defense because they reduce unauthorized access even when an application is exposed to the internet. Strong controls help block brute-force attacks, stolen-credential reuse, and abuse of automation accounts. Defenders rely on them to enforce least privilege, protect sensitive operations, and detect suspicious sign-ins. Attackers often target weak or missing authentication to take over accounts, create persistence, or reach internal features that should never be publicly reachable.