The gate
Every attempt must satisfy one gate. Your people clear it in one scan. It can be your passkey and your MFA, and the decision layer above both.
Factor Assurance Authority to enter
The decision layer in front of your identity provider that proves the attempt.
Factor Assurance decides who is allowed in. Every sign-in attempt resolves to Authorized, Denied or Walked away, and arrives in your SOC as one event with an outcome and an ID.
It stands in front of Okta, Microsoft Entra ID, Google Workspace and JumpCloud, which stay exactly as they are.
Authorizedno friction, on to your identity provider
Deniedstill verified, still denied
Walked awaysaw the gate, left. Still recorded.
Shipped Factor Assurance is shipped and in production.
What you get All three
Detection expires. The gate you impose does not.
Most systems record a success or a failure. Factor Assurance records every attempt, including the walk-away: the attempt that saw the gate and left.
Signal
The passkey lives on the person's phone, bound to the device. Every event arrives resolved, with an outcome you can act on, not a failed login to investigate.
Decision record
Instant detection, before the attempt reaches your identity provider. Every attempt resolves to Authorized, Denied or Walked away, on a durable, correlated record that is auditable months later.
Who this is for
What the CISO can finally answer.
For the person accountable for board reporting and defensible evidence.
How many people tried to get in last quarter?
Every attempt is recorded, including the ones that never crossed a threshold and never became an alert.
How hard was it for them to try?
Every attempt has to satisfy the gate and settles to a record, so the deterrent is measured, not asserted.
Which identities are worth most to an attacker?
Walk-away behavior shows where they press on and where they give up, per user and per workload.
Who this is for
What changes in the analyst queue.
For the analyst who wants alerts worth opening, time to close, and evidence in the ticket.
The queue today
- Failed authentication
- Failed authentication
- Failed authentication
- Failed authentication
- Authorized
- Failed authentication
The failures carry no outcome, so none of them can be ranked.
The queue with AuthLN
- Denied8f2c41
- Walked away8f2c55
- Denied8f2c58
- Walked away8f2c5e
- Authorized8f2c62
- Walked away8f2c71
Each one carries an outcome and an ID that survives. Structured for your SIEM. Illustrative IDs
What an analyst stops doing
ModeledYour analysts spend fifteen minutes working a failed-authentication alert to find out nothing happened. Every attempt through the gate arrives with the outcome already attached, so those fifteen minutes go back to them.
| Users | Analyst-hours back per year | Capacity | Value per year |
|---|---|---|---|
| 500 | 648 | 0.4 FTE | ~$42,000 |
| 2,500 | 3,240 | 1.9 FTE | ~$211,000 |
| 10,000 | 12,960 | 7.6 FTE | ~$842,000 |
| 50,000 | 64,800 | 38.1 FTE | ~$4.2M |
Modeled, not measured. 0.6 authentication-noise alerts per user per month, 80% of them volume-driven, 90% deterred, 15 minutes each at $65 fully loaded. On that model, about 7 in 10 of the authentication alerts analysts work today would stop reaching them. A pilot replaces these assumptions with your own numbers.
Two paths diverge How it works
A passkey answers whether the key fit. We answer what happened.
| Question | FIDO2 passkey alone | Passkey + Factor Assurance |
|---|---|---|
| Question it answers | Is this the right key? | Was this the right decision, and what happened when the answer was no? |
| Outcomes captured | Success or failure | Authorized, Denied, Walked away. The third state is the one most systems never capture. |
| Abandoned attempt | Invisible | Recorded. A walk-away from an untrusted origin is itself a signal. |
| Location check | Single device, no cross-check | Phone GPS against browser geo-IP, with an impossible-travel gate. |
| What survives after | A log line | A durable, correlated decision record, auditable months later. |
Where it sits Okta example
In front of your identity provider. Nothing gets rerouted.
The sign-in path ≈ 1 second for the decision layer, in front of the session
- 01
User requests the app
Browser or app, managed or not.
- 02
Okta evaluates policy
Your tenant, exactly as it works today.
- 03
AuthLN Factor Assurance
The attempt is challenged, and the challenge has two answers.
Paired the pairing holds, on to Okta
Not paired no pairing to present, denied
- 04
Okta issues the session
For authorized attempts. Nothing is rerouted.
Two ways to deploy: layered with Okta Verify, or scoped to privileged and high-risk access only. The same gate stands in front of Microsoft Entra ID, Google Workspace and JumpCloud.
What your SOC sees
One event per attempt, joinable to your identity provider's system log.
- PASS
- authorized, session issued
- FAIL
- denied
- walked away, known or unknown
outcome · correlation ID · timing
IP, ASN, geo · VPN and Tor flags
In your tenant, not ours
Enforcement policy. Group scoping.
We hold no directory and no lifecycle. Your directory, your policy and your lifecycle are unchanged.
The credential Physical and digital
An AI never leaves the digital. Authority lives in both.
Passkeys and tokens can be generated, copied and replayed. Policy and logic can be read, modeled and reasoned around. Bind authority to a physical anchor, and the attempt has to come from a body, not a model.
Device
A key that cannot be exported or lent.
Proof
A proof that cannot be rented, rotated or forged.
Presence
A device in the place, at the moment.
Where it applies
Wherever something authenticates.
The credential
The private key is generated inside the hardware security perimeter and cannot be exported, behind a class-3 biometric. Secure Enclave on iOS, StrongBox on Android.
Device GPS is evaluated at the moment of the attempt and cross-checked against network geolocation.
ML-DSA-65-ES256 hybrid. Post-quantum signatures standardised in NIST FIPS 204, with COSE algorithm identifiers registered in RFC 9964.
Where it runs
Everyday logins in front of your IdP. Every attempt lands in the console with its outcome and its ID.
Gates non-human authentication so automated abuse is deterred. Token, OAuth and agent coverage is roadmap.
A proof-backed step-up behind the firewall, on the actions that matter, at front-door difficulty for an attacker.
Custody is signed at each handoff and re-verified at the next checkpoint. Each scan carries a proof.
The same gate, the same proof, wherever the attempt happens.
The record
Every attempt leaves a record.
A walk-away still leaves a record. The missing device signal is the finding: the shape of the record tells you it was not them.
Every attempt
- Outcome + correlation ID
- Dwell + 4-stage timing
- IP, ASN and geo-city
- VPN, Tor and proxy flags when the network exposes it
When they engage
- Device GPS + accuracy
- Origin trust class when it resolves
What it asks of you
No rip and replace. The gate sits in front, the IdP stays put.
No keys to hold
The proof is produced on their device, never on yours.
No new credentials
Your passkeys and your IdP stay exactly as they are.
No friction for your people
Authorized attempts clear in one scan.
The pilot 30 days
One group. Thirty days. Then look at the record.
- One application, one user group.
- A named owner on your side.
- An hour at each end.
- One measured number.
- Days 1-3ScopePick one application and one user group.
- Days 4-7DeployThe gate goes in front of your existing IdP.
- Days 8-28ObserveEvery attempt proved, resolved and recorded.
- Day 30ReviewYour own numbers in place of ours.
Next
Factor Assurance proves who got in. Next: what acted, and on whose authority.
Once agents are in, they act with people's access. An Agent Access Review shows which agents are running, what each can reach and whose authority they act on. Agent Authority is designed to prove every action from there.