"In general, we are seeing companies moving towards risk-based authentication augmented by mobile soft tokens (sometimes called from a mobile application through an API)," said Andras Cser, Principal Analyst, Security & Risk Professionals at Forrester Research ii in his blog. "These software-only solutions are easier and cheaper to deploy, particularly if the target population is on smartphones, and a lot easier to patch in case of an attack."