WatchGuard AuthPoint is a cloud-managed multi-factor authentication solution. It requires users to verify their identity with a second factor, such as a push notification, one-time password, or QR code, in addition to their regular password. AuthPoint protects VPN connections, cloud application logins, and Windows and Mac workstation logins. Because it runs on WatchGuard Cloud, there is no on-premises server to install or maintain.

When a user enrolls, AuthPoint records a DNA fingerprint of the specific mobile device running the authenticator app. That fingerprint includes hardware and software characteristics unique to the phone. If an attacker copies the authenticator app to a different device, the DNA fingerprint will not match, and the authentication request is automatically blocked. This protects against cloned-device attacks that can bypass standard OTP-based MFA.

Yes. AuthPoint integrates with VPN gateways through RADIUS, including WatchGuard Firebox VPNs, Cisco ASA, Fortinet, Palo Alto, and others. When a user initiates a VPN connection, AuthPoint sends a push notification to their phone. The user approves the request, and the VPN session proceeds. The same flow works with OTP if push notifications are not available.

AuthPoint is primarily a software solution. Users install the AuthPoint mobile app on their iOS or Android device and use push notifications, OTP, or QR code authentication. For users who cannot use a smartphone, WatchGuard also offers a hardware token that generates time-based one-time passwords. Both the mobile app and hardware token are managed from the same WatchGuard Cloud portal.

AuthPoint is licensed on a per-user, per-year basis. You purchase seats for the number of users who need MFA, and subscriptions are available in 1, 3, and 5-year terms. There are no per-device fees. A single user license covers the user's mobile app, hardware token if applicable, and all of the applications and resources they authenticate against through AuthPoint.