Unexpected drop in VIP risk scores after policy configuration change

Products

• VIP Service

Issue/Introduction

The configuration changes below have been made in VIP SaaS to extend the device expiration period via Policies -> Account -> Edit.
Device Fingerprint Expires after: 100 days -> 700 days
No successful authentication for: 90 days -> 180 days

After implementing these changes, a drastic reduction in risk score values between 61 and 100 is observed in the "VIP IA Risk Distribution: Daily Summary Report", starting from that day.

Environment

Symantec VIP Service

Cause

Another policy change was made in February 2025 to the policy 'Always require security code from unauthorized devices'. Due to a bug in VIP Manager, this was inadvertently set to Yes during the policy change in June.

Resolution

The Symantec VIP product team has fixed the issue in VIP Manager.

We recommend reapplying the following policy changes to resolve the issue:
Always require security code from unrecognized devices -> NO
Device Fingerprint after -> 700 days
No successful authentication for -> 180 days