Even when the correct password is entered, an organization can't be fully confident it's the real account holder logging in. Login risk scoring combines multiple signals from the login event itself into a numeric score estimating exactly that — the probability the attempt isn't legitimate.
What the score is actually used for
Organizations use it to decide whether to allow full access, restrict what the session can do, or demand additional authentication before proceeding.
What to evaluate in a solution
- Which signals actually feed the score — device identification, velocity of use, IP geolocation, proxy detection
- Whether the vendor supplies every technique needed, or expects you to source some data externally
- Support for third-party integrations and custom data fields
- Whether you can define your own rules or model features
- Access to shared velocity data across the vendor's other clients, to catch patterns invisible from your data alone
- A numeric score, not just a binary pass/fail
- Whether known-compromised email/password combinations from past breaches are actively monitored
How it works
A code snippet on the login page sends attempt data to the provider, which runs it through proprietary models and rules and returns a score — near real time, often including IP address and device history detail.
What actually happens with the score
- Allow unrestricted access for low-risk attempts
- Deny the login outright for high-risk attempts
- Restrict what a medium-risk session can actually do
- Step up authentication — security questions, two-factor, or a knowledge-based assessment
Priced per login attempt, with volume tiering. Sample vendors: Deduce, Kount.