Risk-based authentication assesses the probability of account compromise with each login.

If the request seems unusual or suspect, the user must do something extra to gain access. Additional factors (like biometrics) ensure that the request comes from a valid user.

Why would this help? Consider this scenario.

Someone wants to access your server. That person has the right username and password, but something about the request seems unusual. The person is logging in from a country in which you don't do business, for example. Or the person is requesting access to a file that only you should see.

Risk-based authentication helps you assess and manage the dangers inherent in the request.