---
title: "Risk Model"
slug: "risk-model-v6-5"
description: "Learn about risk-based access control, user risk scores, and how to configure MFA and identity providers for enhanced security measures."
updated: 2025-12-04T16:41:05Z
published: 2025-12-04T16:41:05Z
canonical: "support.appgate.com/risk-model-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Model

Risk Model itself is now deprecated, however you can still [use the risk scores](/v1/docs/access-control-modes) for access control.

[Risk based access](/v1/docs/access-control-modes) is a way to set up access controls based on a user risk score (provided as a claim) which in turn will decide if the Action(s) specified in the Entitlement are to be allowed. For example: access may only be allowed if the user risk score is medium or low. When the risk score is high then the Entitlement will be denied (block rule applies). If a [user interaction](/v1/docs/applying-access-controls-user-interactions) has been configured in the risk matrix, this will provide a way for the user to unblock access by performing some sort of additional authentication.

## Before you start

Pre-configure the following elements:

- MFA Provider for multi-factor user interactions, refer to [MFA Providers](/v1/docs/mfa-providers)
- Identity Provider for password user interactions, refer to [Identity Providers](/v1/docs/identity-providers)
- You will need a [user risk claim](/v1/docs/applying-access-controls), refer to [User Claims](/v1/docs/user-claims) and [Device claims](/v1/docs/device-claims)
- If you plan to use the risk score claim provided by the Appgate ZTP Risk Engine then you will need to [link your SDP instance to ZTP](/v1/docs/ztp-settings) and obtain a f[eature license for the Risk Engine](/v1/docs/licenses).

Background information:

- The topic [access control models](/v1/docs/access-control-modes#risk-based-access) explores the use of [risk based access](/v1/docs/access-control-modes#risk-based-access) in more detail.
- Learn more about how to use [user interactions](/v1/docs/applying-access-controls-user-interactions)
- Setting up [MFA Providers](/v1/docs/claim-harvesting-multi-factor-authentication) or user interactions

Use the Risk Model form for:

- Defining the risk matrix which can then be used for controlling when Entitlements will be allowed by the Gateway
- Adding user interactions when the risk matrix shows USER ACTION, such as entering a valid multi-factor authentication.
- Adding a message to provide feedback to the user when the risk matrix shows DENY.

For details on completing the form, refer to [configuring the risk model](/v1/docs/configure-the-risk-model)

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.

An appliance that acts as an enforcement point, controlling user access to protected resources.