Pulling Attackers Out of the Shadows
How a Fortune 500 insurance carrier used AuthLN Pay Factor Authentication to eliminate anonymous mass attacks, surface attacker identity, and turn every login into audit-grade intelligence — without replacing a single existing system.
A passkey and an economic factor — not a replacement
AuthLN plugs in as a pre-authentication gate in front of the carrier's existing identity provider. No rip-and-replace — existing SSO and MFA flows stay intact downstream. It adds a factor; it doesn't replace one.
Three pillars
- Pillar I — Device-native FIDO-2 passkey via Secure Enclave / TPM
- Pillar II — Micro-stake Bitcoin Lightning invoice creates economic deterrence
- Pillar III — Every unauthorized attempt is identified, with zero false alarms
- Identity verified before authentication completes — binary, instant
The deterrent invoice
Every unrecognized session triggers a high-value Lightning invoice. Legitimate employees pass via passkey in ~1.2s — the invoice never appears in their path, and they never pay anything. An attacker faces exactly two outcomes:
- Invoice timeout — they abandon. Session logged with origin, timing, and credential used.
- Paid & denied — rare but high-value. Payment address preserved, on-chain UTXO trail available, legal hold initiated.
Device-bound passkey
Private keys generated and stored in the device TPM / Secure Enclave. No shared secret, nothing to phish or replay.
Lightning deterrent
A small invoice stands in front of every unrecognized attempt. For the first time, every attempt actually costs the attacker money.
Forced attribution
Just touching the invoice builds a threat profile on its own — no honeypots or decoys to set up and run.
Unauthorized attempts crater 91%. Authorized logins stay flat.
Legitimate users were untouched; the hostile population self-selected out as the cost-per-attempt signal propagated through attacker networks.
Every invoice an attacker touches starts a threat profile
Traditional MFA either blocks or fails silently — there's no record of who tried, how long they deliberated, or what they were willing to pay. The moment an unauthorized session interacts with a Pay Factor invoice — even just receiving it — attribution begins.
| Signal captured | What it tells you | Action enabled |
|---|---|---|
| Lightning address (recipient) | Attacker-controlled wallet, or one hop removed | Blockchain analytics, law-enforcement referral |
| Invoice dwell time | How long they considered paying — a behavioral signal | Threat scoring, campaign correlation |
| Session origin (IP, ASN, geo) | Geographic source locked to this specific attempt | Geo-block tuning, IOC feed contribution |
| Credential pair used | Which employee was targeted, and how | Targeted-user alert, credential rotation |
| Payment (if made) | On-chain UTXO trail, traceable to an exchange | Legal hold, subpoena package |
Every attempt logged with its outcome
A representative slice of the timestamped audit record.
Recognized device — Boston, MA
Passkey verified via Secure Enclave on a recognized device. Pre-auth gate cleared in 1.2s. No invoice triggered. IdP session granted normally. Clean record preserved for compliance audit.
Unrecognized device — Kyiv, Ukraine (IP 91.234.x.x)
Credential pair matched a known employee account; device not registered. Lightning invoice issued, expired after 600s with no payment. Authentication never completed. MSSP P1 alert dispatched; employee notified.
Synthetic-identity probe — cloud compute, us-east-1
Invoice paid in full. Identity verification failed — no biometric on record. Access denied post-payment. Payment address preserved, legal hold initiated, blockchain analytics engaged.
847 logins this week — 0 unauthorized attempts
First full week with zero invoice timeouts. Automated scanning tools no longer targeting the carrier's domain. Threat-intel feeds confirm AuthLN-protected orgs are being removed from active target lists.
From reactive defense to proactive posture
A per-user, timestamped audit record gives the CISO something rare: a causal before-and-after signal, not a correlation. That data feeds decisions across the security organization.
| Policy dimension | What AuthLN data provides | How the carrier applied it |
|---|---|---|
| Zero-trust policy tuning | Which users are targeted, when, and from where | Stepped-up controls where risk is real; friction removed where it isn't |
| Cyber E&O underwriting | Per-user login history, attempt rates, resolution outcomes | The carrier underwrites its own cyber policies — this feeds the model |
| Board & regulator reporting | Quantified threat reduction with causal attribution | NYDFS 23 NYCRR 500 MFA audit trail; board deck with hard data |
| Incident-response prioritization | P1 events with origin, credential, and dwell-time data | MSSP triage order driven by evidence, not anomaly scores |
| Threat-intelligence sharing | IOC-quality data: IPs, wallet addresses, ASNs, timing | ISAC contribution; pre-built law-enforcement referral packages |
What this deployment also solves
Ransomware chain disruption
Credential stuffing is the first stage of nearly every ransomware chain. Killing it at the pre-auth gate breaks the initial-access vector that enables lateral movement and encryption. One avoided incident can justify the deployment on its own.
Zero false positives
Binary resolution — a user either passes the passkey or doesn't. No "risk score of 74, maybe block?" ambiguity. That's a quantifiable reduction in help-desk hours and eroded user trust.
NYDFS 23 NYCRR 500 artifact
The per-user log with timestamped outcomes is a compliance artifact, not just a security feature — reducing the need for separate logging infrastructure.
MSSP managed-intelligence tier
Monthly decay reports, per-user audit exports, and escalation on paid-and-denied events — a billable managed service tier no traditional MFA vendor supports.
The bottom line
We Make Attackers Pay — literally.
Bring your IdP; keep your stack. We add the factor that changes the economics of every login attempt against you.
Schedule a DemoAbout this scenario. This is an illustrative deployment scenario modeling how AuthLN Pay Factor Authentication performs in a large enterprise identity environment. The organization is described generically as a Fortune 500 insurance carrier; figures are modeled projections, not a measurement of a named customer's production environment. AuthLN, Inc. · U.S. Patents 11,956,366 & 12,118,550.