Should organisations rely on risk-based authentication instead of fixing lifecycle gaps?

Why risk-based authentication cannot replace lifecycle governance

Risk-based authentication is useful because it adds context to a login decision, but it only evaluates the moment of authentication. If an identity is stale, duplicated, misassigned, or still active after offboarding, the control may still approve access for the wrong account because the underlying record is wrong. That is why organisations should treat joiner-mover-leaver governance as the source of truth and not as an optional backstop.

The practical distinction is that risk-based authentication can reduce friction or add step-up checks, but lifecycle controls decide whether the identity should exist, what it should be entitled to, and when access must be removed. When those lifecycle signals are missing, the authentication layer is being asked to compensate for incomplete identity hygiene, which is a control mismatch rather than a security strategy.

What risk-based authentication actually does well

Used correctly, risk-based authentication improves sign-in decisions by looking at contextual signals such as device, location, velocity, and observed behaviour. It is strongest as a step-up control within a broader MFA strategy, where the system can ask for stronger proof when the login looks abnormal. That makes it valuable for reducing account takeover risk, especially where password-based sign-in or help-desk-driven recovery still exists.

It also has operational value because it can lower unnecessary friction when the access attempt is routine and raise friction when the access attempt looks suspicious. But that benefit depends on accurate identity, device, and session data. If the directory is inconsistent, the decision engine can only make a best guess from bad inputs.

Why lifecycle gaps remain the real problem

Lifecycle gaps create a different class of failure from authentication weakness. Stale accounts, missing deprovisioning, unmanaged service identities, and mismatched directories expand the number of identities that can still be used, even when the login step itself is reasonably strong. Workforce identity security is therefore not just about stronger sign-in, it is about keeping the identity inventory current, enforcing offboarding, and removing access when the business relationship ends.

In practice, lifecycle governance determines whether risk-based authentication is protecting a live, legitimate user or simply wrapping a broken identity record in a smarter login flow. If the wrong person, expired worker, contractor, or dormant account still exists in the directory, risk scoring does not solve the root issue. It may slow down abuse, but it does not revoke the access path.

Risk and Threat Considerations

When organisations lean on risk-based authentication as a substitute for lifecycle controls, they create a blind spot around stale identities and orphaned access. Attackers do not need to defeat the risk engine if the account should already have been removed, and any inconsistency between directories, HR records, and application entitlements increases the chance of unauthorised persistence.

Failure mechanism: A compromised, inactive, or misassigned identity remains valid because offboarding, reconciliation, or entitlement cleanup never happened, so the authentication layer is forced to make a decision on an account that should not exist.

Impact: The organisation keeps exposure open after employment ends, after role changes, or after contractor expiry, which increases account takeover blast radius and makes detection and remediation slower.

Practitioner Guidance

What to prioritise: Treat lifecycle fixes as the first-order control and risk-based authentication as a secondary signal. If the directory, HR feed, or entitlement source is unreliable, the authentication policy should be considered a compensating layer, not the primary safeguard.

What to verify: Confirm that offboarding removes access across all major systems, that movers do not retain old-role entitlements, and that dormant accounts are either remediated or explicitly accepted as exceptions. The question is not whether the login flow can challenge suspicious access, but whether the identity should still be present at all.

Practitioner takeaway: Use risk-based authentication to improve decisions at sign-in, but fix lifecycle governance to remove the identities, entitlements, and residual access paths that should never reach sign-in in the first place.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on generic security awareness training instead of behaviour-based risk management?
• Why does the EU CRA push organisations toward risk-based prioritisation instead of fixing every issue equally?
• When should organisations use adaptive or risk based MFA instead of a fixed authentication challenge?
• What breaks when organisations rely on weaker second factors instead of hardware based authentication for sensitive accounts?