The same security strength pays differently across risks and user abilities
Aliases: risk-based authentication · tiered security · adaptive authentication
What it is
The same strength of security measure pays completely differently across risk scenarios and user abilities: strong two-factor on an ordinary account is cheap, high-value protection; for a targeted high-profile individual it may not suffice; an authentication style effortless for young users can be a point of abandonment for older ones. Security strength is not a universal constant — it is a function of scenario times population. This entry is about that function itself.
Why it happens
A measure's payoff is decided by three factors: threat probability (how this scenario is attacked and how often), asset value (the loss on breach), and user capability (the probability the defense is executed correctly). One measure projects differently on all three: SMS codes stop the vast majority of bulk credential-stuffing (no attacker burns a SIM swap on one account) while doing nearly nothing against targeted attack; complex passwords translate directly into write-down rates for users whose typing is deteriorating. One-size-fits-all produces double waste: low-risk scenarios pay friction for nothing, high-risk scenarios rest on imagined protection. The right design shape is therefore layered: tune strength by scenario (risk-adaptive authentication — step-up on new devices or odd locations) and tune form by population (biometrics replacing long passwords), instead of one strength serving all.
Studying it
Evidence comes down three lines: effectiveness evaluations of risk-adaptive authentication (step-up triggers against breach rates); demographic-difference studies (age and ability against success and abandonment rates per authentication method); and grounding measure effectiveness in real incident statistics (which measures actually appear in event data). Common variables are scenario risk level, user age and capability, and measure type; beyond breach rate, the key dependent variables are abandonment and downgrade rates. Methodological caution: experiments mostly measure "what does it stop" and rarely "under what conditions do users give up on protection" — yet the latter supplies the floor data that tiered design actually needs.
Where it stops holding
Tiering presupposes that risk is judgeable: account value is easy to estimate, but per-session risk (new device? odd location?) mispredicts often, and errors cost in both directions — false blocks are friction, false passes are risk. Population tiering must avoid stereotype: older users vary enormously among themselves, so an age-based blanket rule is itself another one-size-fits-all. Privacy costs belong in the same ledger: the contextual signals risk-adaptive authentication consumes (location, device fingerprint, behavioural features) are themselves data collection, and surveillance introduced for security must pass the same review as any other.
Applying it
- Assign measures by account value and threat surface, three tiers to start: ordinary accounts (low-friction 2FA), high-value accounts (hardware keys), shared terminals (session isolation).
- Offer authentication form choices rather than mandating one; for user groups with abnormally high authentication failure rates, simplify the form proactively instead of prompting "try again."
- Verification: after rollout, track two event classes per tier — breaches (line effectiveness) and abandonment/downgrades (usability floor); any tier where the two fall out of balance gets re-tiered.