A second factor that reacts to the situation.
Adaptive MFA applies additional verification based on signals such as device, location context, and behaviour, rather than prompting identically every time. Our work is designing verification policy by population, starting with privileged access.
Adaptive multi-factor authentication changes what it asks for based on risk. The design question is which populations get which rules, and who signs off on the exceptions.
What it is
Adaptive MFA applies additional verification based on signals such as device, location context, and behaviour, rather than prompting identically every time.
It is for organizations that already have a second factor and are finding the blanket version either too weak for privileged access or too heavy for everyday work.
What it does
Verification that scales with risk
Stronger challenges where the risk is higher, rather than uniformly everywhere.
Policy per population
Administrators, vendors, and everyday users held to different standards deliberately.
Where it fits
L1, identity and access. Authentication strength is the control that most directly decides whether a credential is worth stealing. It sits underneath everything, and the exceptions granted here propagate silently upward.
What we do with it
Designing the policy
Which populations, which factors, and which exceptions, written down rather than accumulated.
Privileged paths first
Administrative access is where the strongest policy belongs and where it is most often missing.
Exception handling as an operation
Exceptions are inevitable. Ungoverned exceptions are the failure.
Where it earns its place
An estate with administrative accounts on weak factors
The most privileged accounts are frequently the oldest and the least reviewed.
An organization balancing security against friction
Adaptive policy is how the two stop being a single dial.