Step-up authentication should be triggered by behavioral anomalies, not applied as a blanket policy. Protecting legitimate user experience is itself a security objective.
“Add friction only when something's wrong. Don't punish your real users.”
Friction Belongs to the Attacker
The takeaway
Trigger step-up authentication on anomalies, not as blanket friction.
Save for later
Saved only in this browser. No account needed. Does not sync. Clearing browser data removes the list.