Worldwide security spends increased to over $100 billion in 2018, yet breaches increased again roughly 40%. On average, organizations protect a little over half their resources with multi-factor authentication (MFA), meaning a little less than half are protected with a password. According to the Verizon Data Breach Investigations Report, 81% of reported breaches involved the use of weak or stolen credentials. Attackers are simply walking in the front door.
of breaches involve use of weak or stolen credentials
Average person has roughly 40 online accounts
People reuse same passwords across different accounts
still among most popular password choices in 2018
The SecureAuth® Identity Platform replaces the password with any number of MFA methods combined with our adaptive authentication risk checks. Unlike other vendors who simply stack MFA methods, we supplement MFA with our risk checks to provide confidence in the identity seeking access. Even if an attacker can bypass MFA methods, they cannot get past checks that analyze device, location, IP address, and behavior. SecureAuth has more risk checks than any other vendor.
User Approved Experience
Enhancing the Bottom Line
SecureAuth offers choice among nearly 30 multi-factor authentication (MFA) methods to meet your unique use cases, providing protection beyond passwords alone. But attackers can bypass many popular methods today using real-time phishing, malware, text & voice call interception, phone fraud, and more. SecureAuth provides multiple pre-authentication risk checks that analyze characteristics around device, location, IP address, and behavior. These adaptive authentication risk checks form a protective barrier around access so you can easily identify legitimate users while denying attackers — even those using stolen credentials and ways to bypass MFA methods. Confidently remove passwords to the delight of your users.
Adaptive authentication offers multiple additional safety nets beyond MFA that do not inhibit the daily routine of users and are nearly impossible for attackers to bypass. Do we recognize the device or the location of a particular access request? Do we know the IP address? Has it been anonymized or involved in past malicious activity? Is the phone being used for authentication coming from a known carrier, phone type, and has it been recently ported? Is user behavior consistent with past behavior? These answers and more raise or lower confidence that the user is who they claim to be.
Most industry leaders agree that 20–50% of helpdesk calls are for password resets and each call costs in the range of $15–$70. If an organization has 5,000 users, each user makes one password reset call per year, and 50% of those users need to make a second password reset call, there are 7,500 calls each year. If each call costs $40, the organization spends $300,000 per year on password reset calls! Going passwordless eliminates those calls and therefore those costs. Removing the password has some real bottom line savings.