Research and analysis
Everything that happens after the login.
Session hijacking, remote takeover, token theft, AI agent risk, and the gap between who authenticated and who is actually operating. Written for the people who have to defend it.
- Articles
- 26articles
- Topics
- 10topics
- Last updated
- Last updated October 2026
26 articles
AI Threats
Published
Derrick SmithFounder & CEO
Your AI Agent Has Access. Who Checks Its Next Move?
Knowing which AI agent is working is not the same as knowing its next move is allowed. Why the stop has to live outside the agent, and how to test it.
Read moreCategory Strategy
Published
Derrick SmithFounder & CEO
After the Login: What Your Compliance Evidence Actually Shows
Most audit evidence stops at the login. What continuous session evidence adds to an audit, what it does not replace, and how to govern it.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
The Badge and the Keyboard: Connecting Physical Access to Session Evidence
Badge logs show who entered. Session evidence shows who is operating. How correlating the two answers questions neither can answer alone.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
DLP Watches the Data. Who Watches the Hands?
DLP policies assume the account owner is the one moving data. How evidence about the person at the controls sharpens data protection without replacing DLP.
Read moreSOC Operations
Published
Derrick SmithFounder & CEO
The Automation Trust Gap: Why Identity Playbooks Stall at the Human Step
Identity playbooks often wait for a human because the trigger signal is too vague. What an identity signal needs before a SOC will trust automation.
Read moreThreat Analysis
Published
Derrick SmithFounder & CEO
Who Was at the Keyboard? Session Evidence in Incident Response
Valid credentials, passed MFA, clean endpoint. How Operator Continuity evidence helps responders build a timeline of who was in control, and where its limits are.
Read moreAI Threats
Published
Derrick SmithFounder & CEO
Who Gave the Agent the Keys? AI Agents Working Inside Your Session
When an AI agent works in an employee's signed-in session, logs show the employee. What to record about delegation, scope, and when authority ends.
Read morePost-Login Security
Published
Derrick SmithFounder & CEO
Authentication Ends. Trust Shouldn't.
MFA proves who logged in. It cannot see what happens next. Why post-login security is cybersecurity's biggest blind spot, and how continuous verification closes it.
Read moreSession Security
Published
Derrick SmithFounder & CEO
The Operator Problem
The session is legitimate. The operator may not be. How accounts change hands after login without a single authentication event, and what Operator Continuity means.
Read moreAI Threats
Published
Derrick SmithFounder & CEO
AI Agents Need Identity Too
The first ransomware attack run end-to-end by an AI agent has been documented. Knowing an agent exists is not knowing it is authorized. How controller verification works.
Read moreCategory Strategy
Published
Derrick SmithFounder & CEO
The Security Gap After Authentication
Enterprise security invests heavily in login-time controls, but they share a common architectural assumption: verify the user at login, then trust the session. That assumption creates the largest unprotected surface in enterprise security today.
Read moreThreat Landscape
Published
Derrick SmithFounder & CEO
How Modern Attackers Operate Inside Trusted Sessions
Stolen credentials remain one of the most common ways attackers get in. Attackers log in through the front door, blend into normal operations, and execute high-value actions from inside trusted sessions where existing tools have no visibility.
Read moreThreat Analysis
Published
Derrick SmithFounder & CEO
Session Hijacking in 2026: The Attack That Bypasses MFA
Session hijacking via adversary-in-the-middle phishing, cookie theft, and token replay bypasses MFA entirely. The 2025 Salesforce/Drift breach showed how 700 organizations lost data for 10 consecutive days using this pattern.
Read moreAI Security
Published
Derrick SmithFounder & CEO
AI Agents and the New Attack Surface
OpenAI confirmed in December 2025 that prompt injection is unlikely to ever be fully solved. AI agents now operate inside authenticated sessions with user permissions, and defense must shift from the model layer to behavioral monitoring.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
Completing Zero Trust with Continuous Identity Confidence
Zero Trust verifies identity at login, but every request after that carries the same identity assertion. Continuous session authentication provides the missing Human Confidence signal that completes the framework.
Read moreSession Security
Published
Derrick SmithFounder & CEO
The Token Duration Tradeoff
Session tokens persist for 8–12 hours, and anyone with the token operates as the authenticated user. Shorter tokens hurt productivity. Continuous verification resolves the tradeoff: long tokens, real-time trust.
Read moreSOC Operations
Published
Derrick SmithFounder & CEO
From Alert Fatigue to Behavioral Signal
SOCs drown in environmental alerts: IP changes, location shifts, device mismatches. In a remote workforce, those signals shift constantly. Behavioral patterns are more stable, produce higher-signal alerts, and reduce analyst burnout.
Read moreCategory Strategy
Published
Derrick SmithFounder & CEO
NIST SP 800-63B-4 and the Future of Session Monitoring
NIST SP 800-63B-4 formally addresses ongoing session evaluation. Learn what session monitoring means, which signals NIST identifies, and where Operator Continuity fits in the broader security conversation.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
IAM vs. ITDR vs. EDR vs. UEBA: Where Operator Continuity Fits
IAM, ITDR, EDR, UEBA and behavioral biometrics each answer a different security question. Where Operator Continuity fits alongside the stack you already own.
Read moreSOC Operations
Published
Derrick SmithFounder & CEO
Continuous Authentication Without Constant Lockouts: The Proportionate Response Model
Behavioral security fails when every anomaly becomes a lockout. How a proportionate response ladder handles tired humans, new keyboards, and real takeovers differently.
Read moreCategory Strategy
Published
Derrick SmithFounder & CEO
Continuous Authentication vs. Session Monitoring vs. Continuous Identity Confidence
Continuous authentication, session monitoring, and Continuous Identity Confidence are related but different. What each term means and which question it answers.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
Privileged Sessions: Where Losing Operator Continuity Costs the Most
Privileged sessions carry the highest takeover consequences. Why permission and control are different, and where Operator Continuity strengthens PAM.
Read morePrivacy by Architecture
Published
Derrick SmithFounder & CEO
Content-Blind Behavioral Telemetry: Security Signals Without Reading the Work
Content-Blind telemetry evaluates how people interact, never what they type. What that means, what it does not mean, and the questions buyers should ask.
Read moreThreat Analysis
Published
Derrick SmithFounder & CEO
When a Valid Session Changes Hands: The Evidence Behind Each Takeover
Token replay, remote control, human handoff, and automation break sessions differently. Which evidence classes catch each takeover type.
Read moreSOC Operations
Published
Derrick SmithFounder & CEO
12 Questions to Ask Before Evaluating Session Monitoring
Twelve questions that reveal what session monitoring products can actually see, how they handle uncertainty, and what they should never claim.
Read moreEnterprise Positioning
Published
Derrick SmithFounder & CEO
The Cost of Identity Uncertainty: What Happens After MFA
Strong authentication did not change what happens after login. The financial chain of identity uncertainty and the numbers a pilot must produce.
Read more