RSA Adaptive Authentication offers businesses a robust way to enhance security through risk-based authentication. By continuously analyzing user behavior, it helps reduce fraud and secure digital transactions efficiently.
| Product | Mindshare (%) |
|---|---|
| RSA Adaptive Authentication | 1.4% |
| Microsoft Entra ID | 5.9% |
| Okta Platform | 4.5% |
| Other | 88.2% |
Providing a risk-based approach, RSA Adaptive Authentication evaluates multiple factors to determine potential threats. It uses advanced machine learning algorithms to assess conditions such as user location and device fingerprinting, ensuring an adaptive response to security. Effective for industries needing high security, it supports both on-premises and cloud-based implementations offering customizable security levels to match specific threat landscapes.
What features define RSA Adaptive Authentication?RSA Adaptive Authentication has been implemented successfully across sectors such as banking, healthcare, and e-commerce. Financial institutions leverage it for securing transactions, while health organizations use it to protect sensitive patient data. Online retailers adopt it to assure customers of a secure shopping experience, significantly enhancing trust and user satisfaction.
| Author info | Rating | Review Summary |
|---|---|---|
| Director of Cyber Security at a financial services firm with 1,001-5,000 employees | 1.5 | While log ingestion and alerting are valuable, our product is overly complicated and basically unusable. Implementation took years, the consultants were unproductive, and the ROI just isn't there. |
| IT Security Engineer at a insurance company with 201-500 employees | 3.5 | While we value its stock tokens for user authentication, our old, slow solution lacks web adaptability. Its $50/head cost means we're looking to replace it with a modern SSO like Centrify. |
| Security Architect at Fluid Attacks | 4.5 | As a partner, I find RSA Adaptive Authentication effective for fraud prevention, offering stability, scalability, and great support, leading to customer cost savings. However, I wish for improved search filters and lower infrastructure costs. |
| Senior Developer AIG Digital Security Group at a insurance company with 10,001+ employees | 3.5 | I appreciate RSA Adaptive Authentication's Risk Engine for reducing false positives and improving fraud detection. My primary concern is its lack of new user identity verification during enrollment, alongside occasional erratic risk scores. |
| eBanking Security & Awareness with 10,001+ employees | 3.5 | We found this solution significantly improved our fraud detection, stopping transactions proactively. While policy management is good, reporting needs improvement, and on-premise deployment is complex, demanding sufficient resources and technical understanding. |
| Vice President & Head, Model Risk Management at a financial services firm with 1,001-5,000 employees | 4.0 | I find this product significantly reduced our fraud losses due to its robust algorithms and good support. While it integrates well, I wish for more control, data utilization, and transparency in its methodology for specific business needs. |
There are many use cases that we have defined based on our business needs.
Ingestion of logs and raising alert space on those logs are the most valuable features.
The product is basically unusable. We need better ease of use; it's overly complicated.
It has taken years to implement.
We used RSA consultants for the deployment. Our experience with them was not productive, but we did work with other consultants as well.
The consultants' ability to configure this particular platform is limited based on their knowledge, because it is such a complex product. There are so many classes that you need to take in order to be proficient at it, and there are so few people on the planet who can actually do that. Basically, you need an army of people to keep this thing going.
The return on investment is just not there.
We use it for authentication for users to get on to their primary systems.
The most valuable feature is the stock tokens. That works the best for us.
I would like to see a more adaptive type of solution, something that we could use on our web pages. I would like to be able to give the same ability to a user out there on the internet.
It's stable. It's just old and slow.
Scalability comes down to $50 per head.
Before this solution it was just username and password, strictly.
The initial setup is pretty straightforward. You build the Adaptive name to your server and then you just start adding tokens to it.
The pricing is $50 per head, yearly.
We'll probably go to Centrify or Thycotic.
Look at something like Centrify or something along those lines: a single sign-on solution.
We use the physical tokens and stock tokens. It's an okay solution. It's just old technology and it's time to move on.
I would rate it as a seven out of ten. We're looking to move on from it. It's not a bad product but it's not a great product.
We work for some banks in our country using this solution. We provide support with this specific version (7.1).
We are a partner who is supporting the application for our customers. Our customer are seeing value from the product, as they experience cost reductions. They can stop fraud from their customers, then their customers can have a better experience from their services.
Stopping fraud in the banks.
Better filters when searching for events. The current features for current filters when searching fraud events are not very comprehensive. You can only filter by certain fields in the transaction.
It is really stable. All the banks that we know who use this solution trust almost 100 percent the availability of this solution for their core transactions.
It's really scalable. The response time is very fast.
The support team of RSA is very knowledgeable of this product. They are always there when we need them, so it's a very good support team.
The initial setup is rather long, but it becomes easier when you have done it several times.
We have seen a measurable decrease in the mean time to detect or respond to threats, which is approximately 20 percent.
Customers need to deploy the solution in a very expensive infrastructure. RSA should should think about a less expensive recommended infrastructure for customers because the infrastructure needed to support that solution may be even more expensive than that software price.
We don't experience with another tool.
RSA Adaptive Authentication is one of the most used tools for stopping fraud in the world. The tool is very good variable to take into account when deciding what product to choose. I think RSA is best options in this field since the tool is a really good piece of engineering.
Risk Engine’s risk score, eFN, GeoIP, and device binding all coming together in the Policy Rules to decide when to escalate to MFA.
It has reduced false positives greatly in our fraud detection ability.
RSA Adaptive Authentication lacks a mechanism to verify the identity of a new user in the Enrollment event workflow.
Seven years.
Sometime Risk Scores seem erratic. It might be due to some lack in client integration that we did with some of the consumer applications.
No.
Eight out of 10.
Before and in addition to RSA, we used RSA Authentication Manager SecureID Tokens for MFA in some apps.
It lacked a risk analysis capability to help decide when not to step up.
Keep the proxy service layer on premises. That consumes SaaS security services on the back-end. Letting Cloud service providers use our on-premises directory, as users store, is a good compromise.
Not sure. I haven’t been here that long.
There are newer technologies and offerings from newer and smaller vendors. Look into the list of FinTech companies if you are constrained by budget.
One of the most valuable features is the fraud detection capability with minimal friction in the customer experience. Also, the capability to manage your business policy related to security when required without vendor involvement.
Prior to the implementation of the system, our internet banking fraud team relied solely on customer reports for unauthorized fraud transactions. With the system, the fraud team was more proactive, and managed to stop the transaction even as early as during session sign in. To some extent, the system has managed to identify the fraudulent activities including identity theft originating from similar IP address/country which was a major modus operandi, previously.
Reporting modules is one of the major areas that can be improved further. Understanding of system integration and its infrastructure is also a major area that should be highlighted to the clients planning to have this as on-premise, rather than on the cloud. The complexity of having the system as on-premise can be a liability, if insufficient resources are allocated to the system, from a technical, as well as a business, point of view.
We have used this solution for seven years.
There were issues with stability during the initial setup. Correct hardware version and configuration will come handy for this part. Vendor is very helpful and professional during this period.
In terms of scalability, this was expected since the vendor has provided their advice but due to other issues, we unable to do it on time. Subsequently, it was handled appropriately.
Technical support is very efficient, especially if you opt for the paid support. Nevertheless, without the premium one, the vendor will still be as helpful as required.
No previous solution was used for the same purpose.
The initial setup was complex due to the number of users, as well as the number of transactions involved. The expectation on the system also varies among the stakeholders, making it difficult to obtain the commitment in setting up the default configuration of the system.
You may need to opt for second best if funding is low and the number of users is huge. However, the pricing is able to be negotiated if your user figures are huge.
Operational issues will need to be managed internally, since the vendor will not be able to provide much input on this area. The resource allocation as well as segregation of task among internal unit can cause delay to project timeline.
The algorithms of the protection is based on a locked data set, not just our data set. That's what's in the market right now. It also had good user support. They provide you all the technical details. Additionally, you're able to deep dive into the alerts that are generated. So, you can see which customer has had alerts generated, their other alerts, and it integrates with your existing infrastructure.
Once we started adopting these products, we've seen the fraud losses go down considerably. Now, it's not like we also let some customers come in without that protection system, so we don't do a control experiment technically. Since we installed this system, our fraud losses have come down. It could be that hackers are not attacking us anymore because they know that there's a firewall.
From my perspective, I look at models and the methodologies. I think I would like to see them use more of our data, and give us more ability to control or configure how the protection patterns work for a specific business, and also provide more transparency into the methodology.
I wasn't involved in the deployment.
We've had a couple of downstream incidents. However, in general, they're pretty stable. The advantage we get from this product is that, if it's down for a couple of hours, you can store all the log-ins and you can still run it through the system later on. You can back-check.
To be fair, we've adopted them in the last three or four years. The business volume hasn't grown dramatically over that period, but, yes, we've found that it scales.
I wasn't involved in the setup.
I think two main things are important. One is, does it fit in with your existing infrastructure? Second, what are the costs over maintaining it over the life cycle, not just initial costs? Then third is the ability to configure it as your business changes.
