AI Security
AI that knows your users.
Catches what rules can't.
Every login scored. Every request baselined. ML models trained on YOUR data, running in YOUR binary. No data leaves your infrastructure.
Available on Pro and above. See pricing
Risk scoring
Every login scored before the session exists.
Adaptive authentication turns "is this login risky?" into a number computed on the request path. AuthFI assembles a feature vector from the authentication context — geo-velocity, device fingerprint, network reputation, failed-attempt velocity, and the user's own behavioral baseline — and the model emits a risk score from 0–100. That score, not a static rule, decides whether the user is let in, challenged, or blocked. The whole evaluation happens inline, before a session token is ever minted.
- Per-tenant model: trained on YOUR data — one tenant's baselines never leak into another's scoring.
- In your binary: the score is computed where the auth happens; no login telemetry leaves your infrastructure.
- The problem it removes: a fixed "5 failures = lock" rule punishes a fat-fingered employee and waves through a slow, distributed attack. A score does neither.
{
"subject": "alice@acme.com",
"signals": {
"geo_velocity": "new country (BR)",
"device": "unrecognized",
"network": "residential",
"baseline_match": 0.18
},
"risk_score": 62,
"band": "elevated",
"decision": "step_up_mfa"
}Signals in, a score out, a decision attached — the unit a security review can actually audit.
The signals
What the model actually reads.
A risk score is only as honest as its inputs. AuthFI scores the established signals of account-takeover and bot traffic — the same ones a fraud team would reach for, computed automatically on every attempt.
distance ÷ time vs. physical travel ceiling
TLS / UA / canvas entropy vs. known devices
ASN, datacenter / proxy / Tor exit lists
failed-login rate per IP, per account, per ASN
login hour, cadence, route vs. per-user history
breach-corpus hit on the presented secret
Impossible travel, by arithmetic.
Two authentications from alice@acme.com — one from California, the next from Brazil eleven
minutes later — describe a journey no aircraft can make. The model resolves each IP to a coarse
geolocation and divides distance by elapsed time; when implied velocity exceeds the physical ceiling,
the second login is flagged as a session anomaly regardless of correct credentials. The credentials
were right; the geometry was wrong.
Credential stuffing, by shape.
Stuffing replays leaked username/password pairs at scale, so the tell isn't any one login — it's the
distribution. The model watches failed-attempt velocity across IP, account, and ASN: a burst of failures
from one origin against many accounts is the signature behind 47 failed logins from 185.x.x.x. Rate-limit rules slow it; behavioral scoring names it.
Three intelligence layers
Rules catch the known. ML catches the unknown. LLM explains the why.
No single technique covers the whole threat surface. Deterministic rules are fast, auditable, and zero-latency for the policies you can name in advance; ML generalizes to the attacks you can't enumerate; an LLM turns the resulting evidence into answers a human can act on. AuthFI runs all three, in that order.
Rules engine
Deterministic policies. Rate limiting, geo-blocking, IP allowlists, time-based access. Fast and predictable.
if login_attempts > 5: lock(30m)
if country not in [US, IN]: deny
if time outside 9am-6pm: require_mfaML models
Behavioral baselines per user. Anomaly detection on login patterns, API usage, cloud access. Trained on YOUR data.
baseline: alice logs in 9am-5pm PST
anomaly: login at 3am from new IP
action: step-up MFA + alert adminLLM intelligence
Natural language policy queries. Incident summarization. "Who accessed patient data last Tuesday?" answered in seconds.
> Who accessed prod-db from outside VPN?
3 users in the last 24h:
- bob@acme.com (MFA verified, devops)
- eve@acme.com (no MFA, flagged)Adaptive step-up
Friction only where the risk is.
A static MFA prompt taxes every login the same, whether it's a known laptop on the office network or a fresh device behind a Tor exit. Adaptive step-up maps the risk band to an authenticator assurance level in the spirit of NIST SP 800-63B: low-risk logins pass on a single factor, elevated risk triggers a phishing-resistant WebAuthn/FIDO2 or TOTP challenge, and high risk is denied outright and routed to review.
- Step-up, not gate-up: the second factor appears only when a signal earns it, so trusted sessions stay frictionless.
- Rules still own the floor: a hard policy —
country not in allowlist: deny— short-circuits the score; ML only decides the grey zone. - The payoff: fewer help-desk MFA resets, fewer abandoned logins, and a defensible reason on record for every challenge you raised.
Security dashboard
Real-time threat detection across every layer.
Risk scores, alerts, anomaly detection — the model's verdicts surfaced as a console an on-call engineer reads at a glance.
Across every layer
One model surface, four blast radii.
The same scoring discipline — baseline, observe, flag the deviation — reaches past the login box. Authentication is where access starts, but credential abuse, privilege escalation, and lateral movement play out at the service, cloud, and infrastructure layers. AuthFI runs per-tenant across all four.
Authentication
Login risk scoring, credential stuffing detection, impossible travel alerts, device fingerprinting.
Service access
API usage baselines, abnormal request patterns, privilege escalation detection.
Cloud access
Unusual cloud console activity, credential abuse, out-of-hours access patterns.
Infrastructure
Container anomalies, privileged process detection, network behavior shifts.
Get started
Ready to get started?
Free for 5,000 monthly active users. No credit card required.