In short: Duo risk-based authentication is adaptive MFA in Duo Advantage and Premier. Risk-Based Factor Selection detects attack patterns such as push harassment, push spray and unrealistic travel, then requires stronger factors like Verified Duo Push or passkeys. Risk-Based Remembered Devices cuts a trusted session short when access looks anomalous.
What is risk-based authentication?
Standard MFA treats every login the same: the same prompt, whatever the circumstances. Risk-based (or adaptive) authentication looks at the context of each login and adjusts. Most of the time it stays out of the way; when the signals suggest an attack, it raises the bar.
Duo's version has two parts, both available in Duo Advantage and Duo Premier and configured through policy in the Duo Admin Panel:
- Risk-Based Factor Selection, which decides which authentication methods a user may use for a risky login
- Risk-Based Remembered Devices, which decides how long a trusted browser session can last
Risk-Based Factor Selection
Duo learns what normal looks like for your users and assesses each login in real time, and again after failed attempts. It looks for patterns that match known attacks, including:
| Signal | What it means |
|---|---|
| User-reported fraud | The user flagged a push as suspicious in Duo Mobile |
| Push harassment | Repeated failed pushes against one user, the classic push bombing pattern |
| Push spray | Failed pushes spread across many users |
| Unrealistic travel | A login from somewhere the user could not have reached since their last one |
| Country code mismatch | The device logging in and the phone approving appear to be in different countries |
| Novel ASN | A login from a network (autonomous system number) not seen recently in your organisation's successful logins |
| Device distance | The computer and the phone are unusually far apart |
When Duo detects risk it steps the user up. Until they complete one secure login, or an admin clears it, weaker methods are blocked and only stronger ones are accepted:
| Accepted during step-up | Blocked during step-up |
|---|---|
| Verified Duo Push, including Bluetooth autofill and proximity verification | Duo Push without a verification code |
| Passwordless authentication | Duo Mobile passcodes |
| Passkeys, Windows Hello, Touch ID and FIDO2 security keys, with PIN or biometric verification | SMS passcodes |
| Duo Desktop authentication | Phone callback |
| Yubico OTP passcodes and admin-issued bypass codes | Other hardware token codes, including YubiKey OATH-HOTP codes |
By default the policy uses a six-digit verification code for step-up Verified Push. Bluetooth autofill and proximity verification during step-up need Bluetooth permission for both Duo Mobile and Duo Desktop.
The result is that an attacker who has a password and starts hammering a user with pushes quickly finds that a tap on Approve no longer works.
Risk-Based Remembered Devices
Remembered devices let users skip repeat prompts on a browser they have already verified. Risk-Based Remembered Devices makes that safer. Duo analyses IP address and device patterns for each user, suppresses further prompts for the remembered period (30 days by default), and asks the user to authenticate again before that period ends if it sees anomalous access. It is switched on by default for Advantage and Premier customers.
A few points to plan for:
- Admins can list trusted office networks (IP addresses, ranges or CIDRs) as low risk, which stops unrealistic travel, country code mismatch and novel ASN detections firing for logins from those networks
- It works with browser-based integrations, whether they show the Universal Prompt or the traditional Duo Prompt
- If you use Duo Passport, every application that should share a Passport session must use the same remembered devices setting; risk-based and traditional remembered sessions cannot be shared
What it covers, and what it does not
Risk-Based Factor Selection applies to web applications that use the Duo Universal Prompt and to the named Duo Auth API application. It does not apply to Windows Logon or Duo Unix. Risk-Based Remembered Devices supports browser-based integrations.
Because step-up relies on Verified Duo Push, every application should be on the Universal Prompt; an application still showing the traditional Duo Prompt cannot enforce the code step.
Every risk decision appears in the Authentication Log, where the Risk-Based Policy Assessment column shows when a user was stepped up and why. Preview mode, the default view, lets you see which logins would have triggered step-up before you enforce it. That evidence is useful for insurers and auditors too: see MFA for cyber insurance.
How it fits with the rest of Duo Advantage
Risk-based authentication is one of several Advantage features that work together:
- Duo Passport reduces prompts by sharing a trusted session across apps, and risk signals decide when that trust should end
- Cisco Identity Intelligence looks across Duo and your other identity sources for compromised accounts and risky configurations
- Device trust health checks make sure the computer is fit to use, not just the person
For a feature-by-feature comparison of the editions, see Cisco Duo pricing.
How we help
We switch on risk-based policies in preview first, review what would have been stepped up, tune trusted networks, then enforce, so users are not surprised. We also explain the step-up experience in your user guides. Contact us to add adaptive MFA to your Duo account or to upgrade to Advantage.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Duo risk-based authentication?
It is Duo's adaptive MFA. Duo looks at each login for signs of attack, such as repeated push requests or impossible travel, and when it spots one it requires stronger factors such as Verified Duo Push, passkeys or security keys until the user completes a secure login.
Which Duo edition includes risk-based authentication?
Risk-based authentication is included in Duo Advantage and Duo Premier. It is not part of Duo Free or Duo Essentials.
Will risk-based authentication flag logins from our own offices?
It should not, if you set it up properly. Admins can add office and other trusted networks as low-risk IP addresses or ranges, which suppresses the unrealistic travel, country code mismatch and novel ASN detections for logins from those networks.
Does risk-based authentication work with Windows Logon?
Risk-Based Factor Selection does not apply to Windows Logon or Duo Unix. It covers web applications using the Universal Prompt and the Duo Auth API.
Can I test risk-based policies before enforcing them?
Yes. A preview mode shows in the Authentication Log which logins would have been stepped up, so you can tune settings such as trusted networks before turning enforcement on.