Lesson 1 of 3
Reading
12 min
Trusted devices and risk
Identity is more than a username and password. The device, browser, location, token, and session all help determine whether an access attempt looks normal or risky.
Trusted devices make daily work easier, but they must still be reviewed. A device that belongs to a departed staff member, a lost phone, or a browser from an unfamiliar location can become a security problem.
In practice, a user who logs in from a known laptop and passes MFA is different from a login attempt from a new phone in an unexpected location. The device signal helps security respond proportionally.
Device risk response
| Signal | Risk read | Admin response |
|---|---|---|
| Known device and MFA passed | Normal access pattern | Monitor normally |
| Lost or stolen phone | Active token exposure | Terminate sessions and revoke tokens |
| Departed user device | Stale trusted access | Revoke trust and review account |
| New device in unusual context | Possible compromise or travel | Challenge, verify, or escalate |
Key takeaways
- Device trust adds context to identity decisions.
- Trusted devices should still be reviewed over time.
- Lost or stale devices can become active access risks.
- Risk signals help admins respond without panic.