Cloud-based application security

A method comprising:

• receiving, from a user device associated with a user, a request for processing a transaction through a user account;
• authenticating, by a computer system and via a first-level authentication challenge, the user for accessing the user account according to a first access level, wherein the first-level authentication challenge is performed locally on the user device;
• determining, by the computer system, a set of criteria for processing the transaction without requiring a second-level authentication challenge based on historic interactions between the user and the computer system;
• determining, by the computer system, whether the second-level authentication challenge is required for processing the transaction for the user based on the set of criteria and a first attribute associated with the transaction, wherein the second-level authentication challenge is performed via communications between the user device and a service provider server via a network;
• and
• in response to determining that the second-level authentication challenge is not required for processing the transaction, processing the transaction for the user using a first set of resources associated with the user account.

A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

• receiving, from a user device of a user, a request associated with a user account;
• authenticating, using a first-level authentication challenge, the user for the request according to a first access level, wherein the first-level authentication challenge is performed locally on the user device;
• determining a set of criteria for processing the request without requiring a second-level authentication challenge based on a risk profile associated with the user, wherein the risk profile is generated for the user based on historic transactions conducted by the user through the user account;
• determining whether the user is required to be authenticated using the second-level authentication challenge based on one or more attributes associated with the request and the set of criteria, wherein the second-level authentication challenge is performed via communications between the user device and a service provider server via a network;
• and
• in response to determining that the user is not required to be authenticated using the second-level authentication challenge, providing the user device access to a first set of resources associated with the user account for the request according to the first access level.