Responsive to receiving an authentication request from a device, an authentication server determines a confidence level for the authentication request, generates a confidence-weighted challenge to the authentication request. The confidence-weighted challenge being weighted based upon a confidence level. The authentication server, responsive to receiving a challenge response to the confidence-weighted challenge from the device, determines whether to authenticate the user based upon the challenge response. If the authentication server determines that the challenge response satisfies an expected response known to the authentication server, the authentication server permits authentication of the user to access the device. If the authentication server determines the challenge response does not satisfy the expected response known to the authentication server, the authentication server denies authentication of the user to access the device.