Risk signal

Any single data point that raises or lowers suspicion.

A brand-new email address, a datacenter connection, or a document that fails a check can each nudge suspicion up, while a familiar device can nudge it down.

A discrete feature contributed to a risk model or rule set from document, biometric, device, or behavioral analysis. A feature is a measurable input, such as a yes-or-no flag or a number, that a model or rule can use.

Risk signals come from several sources:

• Document signals, such as a failed security feature check or mismatched data.
• Biometric signals, such as a low face match score or a failed liveness check.
• Device signals, such as an emulator, a new device, or a device linked to many accounts.
• Network signals, such as a datacenter address or a VPN.
• Behavioral signals, such as unusual typing or an impossible speed.

Signals work together in a decision:

1. The system gathers signals during a session.
2. A model or rules weigh them.
3. The result is a score or a decision to approve, decline, or review.

Risk signals sit next to terms that are easy to mix up:

• Trust score is the single number that a model builds from many signals.
• Decisioning engine is the component that turns signals and policy into an outcome.
• Device fingerprinting is one source of device signals.