Overview#
Device Management and Trusted Devices builds a stable fingerprint for every device that signs in, assigns it a trust score based on behavioural signals, and adjusts the multi-factor authentication challenge to match the risk it represents.
A detective logs in from the same agency-issued laptop every day. Making them prove their identity with a second factor on every single login adds friction without meaningfully improving security. But the moment that laptop shows up in an unexpected city at 2 a.m., the platform should treat it very differently. All devices start untrusted: trust is earned over time through consistent, recognisable patterns and explicit user verification, and it can be revoked instantly by the user or by a security administrator responding to an incident.
Open Standards#
- FIDO2 / W3C Web Authentication (WebAuthn) Level 3: Passkey and hardware-token MFA challenges issued during device trust evaluation implement the W3C WebAuthn credential registration and assertion protocol, including AAGUID, attestation type, sign-count, and transport metadata.
- RFC 7519, JSON Web Tokens (JWT): Every authenticated session is carried in a signed JWT; the platform embeds a device-fingerprint claim in each token so that the session is bound to the originating device and tokens presented from a different device context are rejected.
- RFC 8176, Authentication Method Reference (AMR) values: Step-up authentication decisions inspect the authentication method reference claim in the JWT to determine whether a current token already satisfies the elevated-assurance requirement before re-challenging the user.
- RFC 6238, Time-Based One-Time Password (TOTP): TOTP is one of the supported second factors triggered when device trust is absent or degraded; the authentication method used is recorded in the issued JWT upon successful completion.
- ArcSight Common Event Format (CEF): All device registrations, trust changes, and revocations are exported from the append-only audit log in CEF format for ingestion by SIEM platforms such as Splunk, Microsoft Sentinel, and IBM QRadar.
- OAuth 2.0 Bearer Token Usage (RFC 6750): Token-based authentication protects the auditable read and write workflows across the platform.
- W3C User-Agent Client Hints (UA-CH): The device fingerprinting engine combines structured client hints with standard request headers such as User-Agent and Accept-Language, favouring passive environment signals that do not contain personally identifiable information.
Key Features#
Device Fingerprinting and Registration#
The fingerprinting engine generates unique, stable identifiers by analysing browser characteristics, hardware attributes, and client environment signals. IP addresses are deliberately excluded from the fingerprint, so VPN changes and network roaming do not trigger unnecessary re-verification.
- Multi-Factor Fingerprinting: Combines user agent, screen resolution, timezone, language preferences, and HTTP client hints
- Privacy-First Design: No personally identifiable information collected; fingerprints rely solely on browser and hardware characteristics
- High Device Uniqueness: Stable identification across diverse device populations while keeping false positive registration rates low
Device Trust Scoring#
The trust scoring system evaluates device reliability based on usage patterns, authentication history, and geographic consistency. High-trust devices face fewer challenges; low-trust devices or anomalous signals trigger additional verification.
- Time-Based Trust Degradation: Trust expires after 30 days of inactivity (configurable per organisational policy)
- Behavioural Trust Signals: Login frequency, geographic stability, and consistent access patterns all contribute to the score
- Admin Override: Security administrators can force immediate trust revocation for lost, stolen, or compromised devices
Adaptive MFA Integration#
The MFA system adjusts authentication requirements dynamically based on device trust, login context, and real-time risk signals. Supports TOTP, FIDO2 passkeys, SMS, email, biometric, and hardware tokens. Users can opt into device trust periods of 7 to 90 days.
- Risk-Based Authentication: Real-time risk scoring determines whether an MFA challenge is required
- Context-Aware Policies: Location, network, time-of-day, and device trust all influence the decision
- Step-Up Authentication: Sensitive operations trigger additional challenges regardless of device trust level
Device Management Dashboard#
Users have complete visibility and control over every device registered to their account: active sessions, trust scores, last-seen timestamps, IP addresses, and remote revocation.
- Real-Time Device List: Instant updates when new devices are registered or existing devices change status
- Forensic Timeline: Full reconstruction of device access patterns available for incident investigation
Devices Administration Area#
Administrators manage the wider device estate from a dedicated Devices area in Administration. A fleet-level dashboard summarises the device population, a searchable list supports day-to-day lifecycle actions, and a guided wizard walks administrators through registering new devices.
- Fleet Dashboard: At-a-glance counts of total, active, recently seen, and pending devices
- Searchable Device List: Create, edit, and delete devices, with confirmation prompts guarding destructive actions
- Guided Onboarding Wizard: A step-by-step flow that registers a new device and confirms successful enrolment
- Localised in Seven Languages: The entire flow is available in English, German, Spanish, French, Irish, Dutch, and Portuguese
Audit Logging#
All device registrations, trust changes, authentications, and removals are written to an append-only audit log, integrated with SIEM platforms for security event correlation.
Use Cases#
- Law enforcement agencies reducing MFA friction for officers on recognised agency hardware while maintaining strict controls for off-network or unknown devices
- Government IT administrators enforcing re-verification after device inactivity periods aligned to security policy
- Enterprise deployments detecting credential-stuffing attempts through anomalous fingerprint patterns
- Security operations teams remotely revoking device trust during active incidents without waiting for password resets
- Administrators registering a fleet of field devices through the onboarding wizard and tracking pending enrolments from the device dashboard
Integration#
- FIDO2 and TOTP MFA providers for step-up authentication challenges
- SIEM platforms (Splunk, QRadar, Microsoft Sentinel) for device event correlation
- JWT authentication with auto-refresh for session continuity on trusted devices
- Organisational RBAC policies for controlling which roles can approve or revoke device trust
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16