Continuous authentication vs MFA and risk-based authentication
MFA decides once at login, continuous risk-based authentication decides when a context score crosses a threshold, and continuous authentication decides at every consequential action for the length of the session. Two-factor and multi-factor authentication check possession and knowledge, then trust the session until it expires regardless of who uses it. Risk-based authentication recomputes a score from device, location, and velocity and steps up when the score rises. Neither observes who is operating the session after it opens. Continuous authentication adds that operator signal, which catches shared workstations, hijacked sessions, and agents acting inside a human's credentials. The controls are layers rather than substitutes: MFA establishes identity, risk-based policy reacts to context, and continuous authentication covers the interval between. When MagenTrust returns CHALLENGE, the step-up can reuse the existing MFA prompt, so users see friction only when the session actually changes.