A password proves one thing: that whoever typed it knows the password. It says nothing about whether the person typing is actually the legitimate user. Once a credential is phished, stolen, or guessed, the password-based model has no further defense — the attacker is now indistinguishable from the real user, because the only test was knowledge of a secret that's no longer secret.
The grant US11301550B2, "Computer user authentication using machine learning" (issued April 12, 2022, assigned to Cylance Inc.), adds a dimension passwords can't. Its CPC classifications combine the authentication-anomaly class G06F 21/316, the machine-learning classes G06N 7/00 and G06N 20/00, and the access classes H04L 63/0861 and H04L 63/102 — authentication based on learned behavior, not just credentials.
“Systems and methods are described herein for computer user authentication using machine learning. Authentication for a user is initiated based on an identification confidence score of the user. The identification confidence score is based on one or more characteristics of the user.”— U.S. Patent No. 11,301,550 source
The mechanism worth understanding is the behavioral profile. People interact with their systems in characteristic ways — the cadence of their typing, the applications they use, the times and places they work, the resources they touch. A model trained on a user's behavior learns that profile, and a session that deviates sharply from it raises a flag even when the password was correct. The attacker who has the credential still doesn't behave like the user.
For defenders, the practical takeaway is that authentication shouldn't be a one-time gate at login. Behavioral signals let identity be checked continuously, so a session that starts legitimately but is hijacked — or a credential used by the wrong person — can be caught after the password check, not just at it.
The tension, as always with behavioral systems, is between security and friction: a model that's too sensitive locks out legitimate users who simply did something unusual. The patent's value is in making behavioral authentication accurate enough to add real security without becoming an obstacle, which is the balance that determines whether such a layer gets deployed or disabled.