Use both whenever the cost of false negatives is high and users can arrive through low-friction entry points such as signup, login, referral, or promo flows. Behavioural scoring answers how the session unfolds, while device intelligence answers whether the browser context is already suspicious. That is the cleaner decision boundary for modern fraud stacks.
How to draw the line between device intelligence and behavioural scoring
Teams should treat the two signals as complementary, not competing. device intelligence is strongest at entry, because it can tell you whether the browser, device, or network context already looks high risk before the user has done anything. Behavioural scoring becomes more valuable once the session is underway, when typing patterns, navigation, velocity, and transaction behaviour reveal intent.
The practical question is not which signal is “better,” but which one reduces decision error at the cheapest point in the journey. If a flow has low-friction access and high abuse pressure, combining both gives you earlier suspicion screening plus in-session refinement. That is why the boundary is usually based on identity fraud prevention guidance: protect the entry point with context signals, then confirm or reject risk with live behaviour.
Where each signal does the most work
Device intelligence is best when you need to answer, “Should we trust this environment enough to proceed?” It is useful for signup, login, password reset, referral abuse, promo abuse, and other touchpoints where attackers try to look like ordinary users. The value is in detecting suspicious fingerprints, emulators, tampered browsers, impossible geo patterns, or device reuse before the session accumulates more evidence.
Behavioural scoring is best when you need to answer, “Does this session look consistent with normal human activity?” It is more sensitive to interaction quality, pacing, hesitation, page traversal, and fraud automation patterns. On its own it can miss early-stage abuse because a fresh account can still behave plausibly for a short time. On the other hand, it can add strong discrimination after the first request or two, when the session leaves a behavioural trail.
The cleanest operating model is stage-based. Use device intelligence to set the initial trust posture, then let behavioural scoring update that posture as more evidence arrives. That sequencing matters because a poor device context can justify friction or step-up controls even before the user has generated enough behavioural data to score confidently.
When to combine them, and when one is enough
Combine both when the business cost of a false negative is high, especially in journeys that attract bots, fake accounts, synthetic identities, account takeover attempts, or promo harvesting. In those cases, either signal alone is usually too easy to game. Device intelligence catches suspicious environments that would otherwise sail through a clean-looking first interaction, while behavioural scoring catches accounts that start clean but diverge once they begin interacting.
Use one signal alone only when the abuse cost is lower, the journey is short, or operational friction must stay minimal. For example, if the consequence of a missed case is limited and the funnel is highly sensitive to delay, a single well-tuned control may be enough. But when the outcome can include account abuse, downstream fraud loss, or manual review overload, the combination is usually the more resilient design.
If you are deciding where to spend engineering effort, prioritise the signal that fails least gracefully in your flow. If attackers can cheaply rotate behaviour but not environment, device intelligence deserves more weight. If they can control infrastructure but struggle to sustain human-like interaction, behavioural scoring becomes the stronger discriminator. Good stacks do not force one signal to carry the entire decision.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Abuse-prone entry flows can expose overly trusted automation and service paths. |
| NHI-10 — Human Use of NHI | Fraud stacks often involve human and non-human signals in the same journey. | |
| Recommendation — Limit standing access for high-risk automation and tighten approval for sensitive entry flows. Separate human interaction checks from machine-context signals in risk decisions. | ||
| CIS Controls v8 | CIS-5 — Account Management | Entry-point abuse and account creation controls depend on strong account governance. |
| Recommendation — Harden account lifecycle controls around signup, login, and recovery flows. | ||
| MITRE ATT&CK | T1110 — Brute Force | Low-friction entry points are common targets for automated credential and account abuse. |
| Recommendation — Hunt for repeated authentication abuse and automate throttling on high-risk entry points. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Login and session entry decisions depend on reliably identifying suspicious access attempts. |
| Recommendation — Strengthen authentication checks where automation or replay can mimic legitimate users. | ||
Practitioner Guidance
What to prioritise: Start with the entry points that are both high volume and high abuse value. Signup, login, referral, and promotional flows usually justify the combined model first because they offer the best chance to stop bad activity before it spreads across the account lifecycle.
Decision rule: If the journey can be abused before enough behavioural evidence exists, lead with device intelligence and then let behavioural scoring refine the result. If the session is already long enough to generate reliable interaction data, behavioural scoring can carry more of the decision weight.
What to verify: Check that the two scores are not just concatenated into one opaque risk number. Teams get better outcomes when each signal retains its own role, so reviewers can tell whether the environment is suspicious, the session is suspicious, or both.
Common mistake: Do not assume behavioural scoring can replace device intelligence simply because the behavioural model is more dynamic. In low-friction abuse paths, the earliest context often matters more than the richest later-stage signal.
Practitioner takeaway: The best test is whether the control can still make a useful decision before the attacker has had time to blend in. If not, you need both signals, not one.
Related resources from NHI Mgmt Group
- How should security teams combine device identification and device intelligence?
- How should fraud teams combine behavioural signals and device fingerprinting?
- How should security teams combine identity data with behavioural risk scoring?
- How should fintech teams combine device intelligence and AI risk decisioning to reduce fraud without adding too much friction?