Risk Analysis
Risk Analysis only operates on authentication flows performed through SecTrail's web interface: Mobile App Registration and SSO (Single Sign-On) logins. It does not apply to RADIUS, Windows Logon, or other protocol-based authentication flows.
Risk Analysis is a real-time behavioral security engine built into SecTrail MFA. At each login attempt, the engine evaluates dozens of contextual signals — IP reputation, geographic location, device fingerprint, login timing, and account behavior — and produces a numeric risk score. Based on this score, the system can transparently allow the user through, inject additional MFA factors, or block access entirely.
How It Works
Every time a user attempts to authenticate, the Risk Engine runs in the background:
- IP Resolution — The client IP is extracted from the configured HTTP header or from the direct connection.
- Geo & ASN Lookup — Country, region, city, coordinates, and Autonomous System Number (ASN) are resolved from the IP.
- Device Fingerprinting — The user-agent string is parsed to extract browser, operating system, and device type.
- History Comparison — The user's recent login history (last 50 successful logins) is loaded and compared against the current attempt.
- IP Reputation Check — All enabled reputation sources are queried (built-in feeds or custom sources).
- Signal Evaluation — Five context evaluators run in parallel:
- Reputation — Known bad IPs, blocklists
- Location — Impossible travel, new country, VPN/Tor/datacenter ASN
- Identity — Dormant account, first login, repeated failures
- Time — Unusual hour, nighttime, weekend, timezone mismatch
- Device — Bot detection, new device, browser/OS/fingerprint changes
- Score Calculation — Each triggered signal contributes a weighted score. The total score is mapped to a severity level.
- Action — Based on the active Risk Policy, the system allows, challenges, or blocks the login.
Severity Levels
| Level | Default Score Range | Action |
|---|---|---|
| Safe | 0 – 29 | Login proceeds normally |
| Low | 30 – 49 | Additional MFA factors injected |
| Moderate | 50 – 99 | Additional MFA factors injected |
| High | ≥ 100 | Access blocked (IP and/or user, configurable) |
Thresholds are configurable per Risk Policy.
Main Sections
- Dashboard — Real-time overview of risk events, score distribution, top signals, risky users and IPs
- Policies — Create and manage risk policies with custom thresholds and block actions
- IP Reputation Sources — Configure built-in and custom IP reputation feeds
- Events — Browse, filter, and investigate individual risk events with full detail
- Blocks — View and manage active risk blocks; create manual blocks