What breaks when organisations rely on geography alone for adaptive login decisions?

Why Geography Alone Fails as a Trust Signal

Location is a weak proxy for trust because it says little about who or what is actually authenticating. Country data can be distorted by VPNs, mobile carrier routing, cloud egress, roaming users, and compromised endpoints that simply appear local. NIST guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls treats access decisions as control decisions, not geolocation guesses. For identity teams, the risk is obvious: geography can enrich a decision, but it should not define it.

That matters most in adaptive login flows, where teams use country matching as a shortcut for fraud detection, step-up prompts, or outright blocking. The problem is that legitimate users travel, work remotely, and authenticate through networks that collapse location into a misleading signal. Meanwhile, attackers routinely route through infrastructure that makes risky sessions look familiar. NHIMG research on the Microsoft Midnight Blizzard breach shows how trusted-looking access can still mask serious compromise when teams rely on narrow indicators.

In practice, many security teams discover the weakness of location-based trust only after a legitimate user is locked out or a malicious session has already blended into normal traffic.

How Risk-Based Login Decisions Actually Work

Effective adaptive authentication combines geography with higher-signal inputs: device health, identity assurance, behavioural patterns, session history, and the sensitivity of the requested action. Current guidance suggests treating location as one feature in a broader risk score, not a pass/fail gate. That approach aligns with NIST SP 800-53 Rev 5 Security and Privacy Controls, which emphasises layered control design and monitoring rather than single-factor trust decisions.

A practical implementation usually follows three steps. First, establish baseline context for each user, device, and application, including normal countries, networks, and device posture. Second, evaluate the current login against multiple signals at request time, not just at initial enrolment. Third, choose a response that matches the risk, such as allowing access, requiring step-up authentication, or restricting high-value actions. This is where geography can still be useful: it can help spot impossible travel, suspicious proxies, or unusual cross-border movement, but only when compared with other context.

NHIMG’s Ultimate Guide to NHI is especially relevant here because the same false confidence appears in machine access when organisations assume a network origin proves legitimacy. That pattern is visible in breaches such as the Salt Typhoon US telecoms breach, where stolen credentials and trusted pathways enabled stealthy access.

These controls tend to break down in cloud-hosted and mobile-first environments because egress location is often determined by shared infrastructure rather than the user’s actual physical presence.

Common Edge Cases and Operational Tradeoffs

Tighter location checks often increase user friction, so organisations need to balance fraud reduction against travel, roaming, and remote-work exceptions. There is no universal standard for treating geography as a hard control, and current guidance suggests using it as a soft signal whenever network topology makes attribution uncertain.

False positives are common for executives, field staff, and contractors who switch between countries, as well as for users behind corporate VPNs or privacy-preserving mobile carriers. In those cases, step-up authentication is usually safer than denial. For high-risk transactions, location can still support policy decisions, but only if the decision engine also considers device compliance, impossible-travel logic, and recent authentication history. That is consistent with the broader direction of NIST SP 800-53 Rev 5 Security and Privacy Controls and NHIMG’s warning that identity signals become unreliable when they are treated in isolation.

Where organisations usually get this wrong is by turning a weak confidence signal into a policy boundary. Once that happens, adversaries only need a clean-looking IP path, while legitimate users end up paying the operational cost.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on CVSS alone for remediation decisions?
• What breaks when organisations rely on indefinite access for privileged systems?
• What breaks when organisations rely on manual access administration in large hybrid environments?
• What breaks when organisations try to govern cloud access with proxies or bastions alone?