Continuous session risk scoring

Design a continuous (post-login) authentication / session-risk system: most products authenticate at login and then trust the session for hours, but you want to keep scoring a session AFTER login and demand step-up (or kill the session) the moment risk rises, e.g., the device fingerprint shifts mid-session, the IP hops countries impossibly fast, or behavior looks scripted. This runs inline for 50M sessions at ~150k actions/sec and must add <15ms to a request. Discuss the signals, where the risk model runs without blowing the latency budget, how a risk spike triggers step-up without disrupting low-risk users, and how you avoid false-positive lockouts.