RSA SecurID

Enterprise MFA and identity assurance across cloud, hybrid, and on-premises environments

Cybersecurity Identity & Access www.rsa.com

Visit Website

Founded

1982

Starting Price

About RSA SecurID

RSA SecurID is the multi-factor authentication and identity assurance line from RSA Security, built for banks, government agencies, and other high-assurance organizations that still run significant on-premises infrastructure. It combines hardware and software authenticators (SecurID 700 tokens, DS100, iShield Key 2, the RSA Authenticator App) with the on-premises RSA Authentication Manager server, and connects to the cloud-delivered RSA ID Plus platform for passwordless, SSO, and adaptive access. Its differentiator is hybrid failover: authentication keeps working on-premises when the cloud or the internet connection does not.

Pros & Cons

Pros

Hybrid failover keeps authentication working during cloud outages or network disruptions, which almost no cloud-first identity provider offers
Unusually broad authenticator range in one contract: OTP hardware tokens, FIDO2 keys, push, biometrics, QR code, and offline codes
Deep coverage of on-premises and legacy estates (RADIUS, VPNs, Linux, macOS, web proxy) that SaaS-only IdPs tend to skip
Purpose-built for regulated sectors, with public-sector and financial-services deployments and NIST CSF 2.0 alignment
Layers on top of Microsoft Entra ID via the M1 plan and External Authentication Methods instead of forcing a rip-and-replace
Publishes per-user list pricing for four of five subscription tiers, which is rare in enterprise identity

Cons

Hardware tokens carry real per-user cost plus replacement and distribution logistics, a recurring complaint in reviews
On-premises Authentication Manager is meaningfully more complex to deploy and administer than a SaaS-only identity provider
The E3 plan holding RSA Risk AI and Mobile Lock is quote-only, so the features that most differentiate the platform have no public price
Reviewers consistently rate total cost of ownership higher than cloud-native MFA alternatives
Manual OTP entry feels dated next to push-first and passkey-first competitors
Full identity governance sits in a separate Governance & Lifecycle product line, and access reviews are still listed as planned in ID Plus

Key Features

Hybrid authentication failover

Cloud MFA that fails over to on-premises RSA Authentication Manager, so users keep authenticating during cloud outages or network disruptions. RSA markets this as the only hybrid failover authentication platform on the market.

RSA Authentication Manager

The on-premises authentication, access, and management server behind SecurID, securing users, applications, data, and services inside the firewall. Also deployable on the security-hardened SecurID Hardware Appliance.

Hardware authenticators

SecurID 700 OTP tokens, DS100 hybrid authenticators, and the iShield Key 2 FIDO2 series, procured from the same vendor as the platform rather than a third party.

RSA Authenticator App

Mobile software authenticator supporting push approval, OTP, biometrics, Windows QR-code sign-in, and offline authentication when the device has no connectivity.

Passwordless and FIDO2

FIDO2 security keys and passkeys, biometrics, and QR-code authentication for phishing-resistant sign-in across cloud, hybrid, and on-premises resources, including Linux and macOS endpoints.

RSA Risk AI

Machine-learning risk engine that scores dozens of behavioral characteristics and business context in real time to decide whether a session needs step-up authentication. Available only in the top ID Plus E3 plan.

RSA Help Desk Live Verify

Bi-directional passwordless identity verification between caller and help desk agent, aimed at blocking the social-engineering and MFA-reset fraud used in recent ransomware intrusions.

RSA Mobile Lock

Checks managed and BYOD mobile devices for threats before allowing them to complete an authentication, so a compromised phone cannot be used as a trusted factor.

SSO and adaptive access

Single sign-on with contextual and adaptive access policies, self-service enrollment and credential management, emergency access, and password reset through RSA My Page.

Broad protocol and directory support

SAML 2.0, OIDC, RADIUS, web proxy, Windows, macOS, and Linux integrations, with user stores in ID Plus Cloud Directory, Active Directory/LDAP, Microsoft Entra ID, the Authentication Manager internal database, or custom SCIM sources.

Pricing

ID Plus C1 (Cloud IAM)

$3/user/month

Cloud-only deployment
Modern MFA with FIDO, biometrics, and Windows QR code
Self-service enrollment and credential management
Federation, SAML 2.0, and OIDC integrations
Basic 9x5 support

ID Plus E1 (Hybrid auth)

$5/user/month

Cloud, hybrid, and on-premises deployment
Hybrid MFA with FIDO, biometrics, Windows QR code, and offline authentication
Third-party authenticator support
Unified management across environments
Federation, RADIUS, macOS, and Linux integrations
Enhanced 24x7 support

ID Plus M1 (Entra ID Enhanced)

$6/user/month

Everything in hybrid authentication, tuned for Microsoft Entra ID
RSA Help Desk Live Verify
MFA resilience for Entra ID outages
Hybrid and legacy authentication
Microsoft Entra ID, Federation, RADIUS, macOS, and Linux integrations
Enhanced 24x7 support

ID Plus E2 (Hybrid IAM)

$7/user/month

Most popular plan
Hybrid authentication and access
Single sign-on and secure enrollment
Adaptive access policies
FIDO and QR code authentication
Help desk protection
Enhanced 24x7 support

ID Plus E3 (Hybrid IAM+)

Custom

Everything in E2
RSA Risk AI risk-based access
RSA Mobile Lock device threat detection
Advanced adaptive access controls
Web proxy integration
Premium 24x7 support
Contact sales for pricing

Best For

MFA for regulated, high-assurance organizations

Banks, government agencies, and healthcare systems that need audited, standards-aligned authentication with hardware token options and both cloud and on-premises coverage.

Resilience layer for Microsoft Entra ID

Organizations standardized on Entra ID add RSA as an external authentication method so sign-in survives a Microsoft outage and legacy apps Entra cannot reach stay protected.

Securing legacy and on-premises access

VPNs, RADIUS-based network gear, Linux and macOS logins, and internal applications that predate SAML get modern MFA without being migrated to the cloud first.

Stopping help desk social engineering

Help Desk Live Verify replaces knowledge-based caller verification with a passwordless, bi-directional check, closing the MFA-reset path attackers use to take over accounts.

Phased passwordless rollout

Teams move from OTP tokens to FIDO2 keys, passkeys, and biometrics gradually, keeping mixed authenticator populations on one platform during the transition.

Tags:mfa multi-factor-authentication passwordless identity-and-access-management sso fido2 zero-trust enterprise-security hardware-token