The Overlooked Attack Surface
We protect apps with MFA, but we leave network admin panels protected by admin/admin123.
Gartner reports that 60% of network intrusions use compromised network device credentials. One compromised firewall = full network control.
The Problem with Static MFA for Network Devices
Traditional RADIUS MFA asks for OTP every time, leading to MFA fatigue for network admins. They start approving blindly.
What is Risk-Based MFA for Network Devices?
Risk-based MFA evaluates the context of every login attempt to firewalls, routers, switches, and VPNs.
AuthNull calculates a risk score based on:
- Location — login from an unknown country?
- IP Reputation — is the IP from Tor / a malicious list?
- Time — a 3 AM login attempt?
- Device — a new admin laptop?
- Behavior — 5 failed attempts before success?
Low Risk
Allow with push.
Medium Risk
Require push + TOTP.
High Risk
Deny + alert SOC.
How It Works with AuthNull
- Point your Palo Alto, Fortinet, Cisco, or Juniper devices to AuthNull RADIUS.
- AuthNull intercepts the RADIUS request and checks the user in AD/Entra ID.
- The policy engine checks the risk score and triggers the appropriate MFA.
- Full audit log: admin@firewall, 14:32, IP 10.1.2.3, Risk=High, Action=Denied.
Benefits Over Traditional RADIUS
- No more MFA fatigue
- Stops impossible travel attacks
- Protects VPNs from credential stuffing
- One platform for all network vendors
Your network is only as strong as your firewall login. Secure it with AuthNull Risk-Based MFA.