WatchGuard AuthPoint is a cloud-based multi-factor authentication (MFA) service. Users verify their identity with a second factor, like a push notification, QR code, or one-time password, on top of their regular password. AuthPoint protects VPN connections, cloud application logins, and Windows and Mac workstation logins. Because it runs in WatchGuard Cloud, there's no authentication server to build out. Some setups, like RADIUS VPNs and Active Directory sync, use the lightweight AuthPoint Gateway installed on your network.

When a user enrolls, AuthPoint records a DNA fingerprint of the specific mobile device running the authenticator app. That fingerprint includes hardware and software characteristics unique to the phone. If an attacker copies the authenticator app to a different device, the DNA fingerprint will not match, and the authentication request is automatically blocked. This protects against cloned-device attacks that can bypass standard OTP-based MFA.

Yes. AuthPoint works with VPN gateways that support RADIUS, including WatchGuard Firebox, Cisco, Fortinet, Palo Alto, and others. When a user starts a VPN connection, AuthPoint sends a push notification to their phone, and the session proceeds once they approve it. OTP works as a fallback when push isn't available. Third-party RADIUS clients connect through the AuthPoint Gateway, while Fireboxes on Fireware 12.7 or higher connect to AuthPoint directly.

AuthPoint is primarily a software solution. Users install the AuthPoint mobile app on their iOS or Android device and authenticate with push notifications, OTP, or QR codes. For users who can't use a smartphone, WatchGuard also offers hardware tokens that generate time-based one-time passwords. Tokens are purchased separately, and both the mobile app and hardware tokens are managed from the same WatchGuard Cloud portal.

AuthPoint is licensed per user, with pricing tiers based on user count and term length. You buy seats for the number of people who need MFA, and each license covers that user's logins across VPN, cloud apps, and workstations. WatchGuard also offers AuthPoint Total Identity Security, which adds a corporate password manager and dark web credential monitoring on top of MFA.