Managing adaptive access

Verify includes continuous adaptive authentication.

When organizations grant users access to their digital apps and services, they face the challenge of having to balance risk considerations with user experience. Businesses must protect their systems from malicious access and avoid user frustration in dealing with unnecessary and sometimes cumbersome authentication procedures. IBM® Security Verify Adaptive Access helps businesses to efficiently reconcile both needs without compromise.

Verify Adaptive Access uses deep identity insights, through a sophisticated risk calculation engine (IBM Trusteer®), to accurately match access policies to the user profile throughout their digital interaction with the application. Use Verify Adaptive Access to enforce the appropriate level of authentication and to block access only when needed so that trusted users can freely interact with your system.

Verify Adaptive Access provides the following main capabilities:
  • Risk-based access policy editor.
  • Web and mobile continuous authentication across the user journey.
  • Low code effort deployment, through an orchestrated risk and access solution.
  • Protects SaaS, custom, and mobile applications.
  • Deep digital identity risk analysis powered by IBM Trusteer AI risk engine:
    • Device fingerprinting
    • Device hygiene assessment (Checks for issues like malware, and rooted or jailbroken devices.)
    • Suspicious user behavior
    • Threat intelligence

    • Web Behavioral Biometrics. (Detects behavioral typing anomalies during traditional username and password authentication. For more information, see Enabling Behavioral Biometrics.)

Use cases

Workforce-authentication use case
An employee in the sales department is attempting to access a financial app that is provided by the company to monitor department expenses. The employee is trying to access from a new mobile device. Immediately after the user enters the credentials, the system identifies the device as a ‘new device’ and triggers a step-up authentication of the user.
Consumer–frictionless use case
An airline customer is attempting to access their mileage account. The customer is requesting access from a known device, which was previously identified as non-malicious, and is connecting from a known location at a normal time. Because of these factors, the system does not burden the customer with extra authentication. The system intelligently delivers a frictionless user experience throughout the session, without compromising security.