Back to All News

Login Risk Assessment and Adaptive Two-Factor Enforcement

May 5, 2026
SECURITY
Airtool Team

Airtool Studio introduces a new intelligent security layer that evaluates login risk in real time and enforces two-factor authentication only when needed. Instead of applying static security rules, each login attempt is analyzed based on user behavior. The system determines whether to allow access, request additional verification, or block the attempt.

How It Works

Every login is evaluated using a behavioral profile built from the user’s historical activity. The system analyzes signals such as location, device, login patterns, and timing to calculate a risk score from 0 to 100.

Based on this score, three actions are applied:

  • Allow (0–29): Normal access with no interruption
  • Require MFA (30–59): Two-factor authentication is requested
  • Block (60–100): Access is restricted and flagged as high risk

If a user does not yet have two-factor authentication configured, access is allowed and the administrator is notified.


Key Risk Signals

The risk score is calculated using multiple behavioral signals:

  • Location and geographic consistency
  • Impossible travel detection
  • Device recognition
  • Login attempt frequency
  • Time-of-day anomalies
  • Authentication method changes
  • Account history maturity

These signals are combined into a single weighted score to ensure consistent and accurate evaluation.

Administrator Visibility

When a login attempt is classified as risky, security teams are automatically notified.

Each alert includes:

  • The user involved
  • The action taken
  • A detailed breakdown of the risk analysis

This provides full visibility into authentication decisions without requiring manual monitoring.

Configuration

The feature is enabled by default and requires no development.

To activate notifications:

  • Set a security email in the mail_report_security field
  • Ensure SMTP configuration is correctly set

Why It Matters

This approach enables a more advanced security model:

  • Stronger protection against unauthorized access
  • Reduced friction for trusted users
  • Real-time detection of suspicious behavior
  • Seamless integration with existing authentication flows

Final Perspective

Adaptive authentication introduces a dynamic approach to access control, where security decisions are based on real-time context instead of fixed rules.

This ensures that protection scales with system usage while maintaining a consistent user experience.