MindVault Concept: Post-Login Gap. The period between a successful login and the end of a session, when most checks stop verifying who is operating. For an audit, it is the stretch the evidence does not cover.

Ask a security team how they show auditors that only authorized people use sensitive systems. You will usually get a stack of login evidence:

  • MFA enrollment reports
  • Password policy settings
  • Access reviews
  • Session timeout settings

All of it is real. All of it describes the front door.

Access standards were built around the login because that is where identity was checked. But it leaves a quiet assumption inside every audit package: the person using the account is the person who logged in. Few organizations can show evidence for that. Fewer are ever asked to.

What the standards already ask

Some rules already reach past the login, even without the word "continuous."

  • PCI DSS Requirement 8.2.8 requires reauthentication after 15 idle minutes. The PCI Security Standards Council says the purpose is to keep an unattended console from being used by someone else.
  • The HIPAA Security Rule includes standards for person or entity authentication and for automatic logoff.
  • NIST SP 800-63B-4 recognizes session monitoring as a risk reduction measure and lists typing cadence among the signals. We explained that guidance in NIST SP 800-63B-4 and the Future of Session Monitoring.

All three share one worry: an open session in the wrong hands.

Timers and logoff rules catch the walk-away. They do not see a takeover that happens while the session is busy.

What continuous evidence adds

No product makes an organization compliant on its own.

What continuous identity evidence adds is an answer to a question that comes up after almost every incident: who was in control of this account when that happened?

Today, that answer gets rebuilt from logins, IP addresses, and device records. Those describe the account. They do not describe the operator.

A session-level confidence record can show, for a sensitive window, whether the evidence:

  • stayed consistent with the authorized person,
  • dropped, or
  • was not enough to judge.

That helps in three places:

  • High-risk workflows. An added layer of control on payments and privilege changes.
  • Disputed access. A timeline when someone asks, "Was that really me?"
  • Policy proof. A record that the response to a confidence drop followed written policy.

One detail separates strong evidence from weak: a request is not an outcome. Asking a user for another verification does not prove it happened. Asking a tool to pause an action does not prove the pause took effect. The record should show what was requested, what actually happened, and who reviewed it.

The evidence needs governance too

Every compliance leader will spot this, and they are right. Behavioral evidence is data, and it needs rules.

Under GDPR, data about a person's behavioral characteristics that allows or confirms their unique identification can count as biometric data, a special category with stricter rules. Content-blind design shrinks what is collected, since no typed content, passwords, or screens are captured. It does not take the remaining telemetry outside privacy law. We covered that boundary in Content-Blind Behavioral Telemetry.

Settle these questions before day one:

  • What is the lawful basis, and is a privacy impact assessment required?
  • Have employees been told what is measured and why?
  • How long is session evidence kept, and who can see it?
  • Is it used only for security, and never for performance reviews?

A control that creates a new privacy problem has not reduced risk. It has moved it.

This idea has deep roots. It reminds us of Ann Cavoukian's Privacy by Design, written when she was Ontario's Information and Privacy Commissioner. Two of her seven principles stayed with us while writing this: make privacy the default, and treat privacy and security as positive-sum, where neither side has to lose for the other to win.

One question for your next audit cycle

Pick your three most sensitive workflows. For each one, ask:

What evidence shows the authorized person was in control between login and the sensitive action?

If the answer is a login record and a timeout setting, that is the gap. The evidence stops right where an attacker's work begins.

That stretch is the post-login gap we described in The Operator Problem. Measuring it as a confidence signal across the whole session is what we call Continuous Identity Confidence.

MFA proves who logged in. MindVault measures who stayed.

Frequently asked questions

Does continuous identity monitoring make us compliant?

No. Compliance depends on your whole control environment and your auditor's assessment. Continuous identity evidence can support access control goals and investigations, but it does not satisfy a framework by itself.

Does any regulation require behavioral session monitoring?

Not as a general requirement today. NIST SP 800-63B-4 describes session monitoring as something that may be performed to reduce risk. Some requirements, like PCI DSS idle-session reauthentication, address the same concern through simpler means.

Is behavioral telemetry personal data?

It can be. When behavioral data is linked to a person and used to recognize them, laws such as GDPR may treat it as personal data, and in some cases as biometric data. Involve privacy counsel and complete any required assessments before deployment.

What should we keep for audit purposes?

That is a policy decision for each organization and its counsel. A sensible start is a minimal record: confidence changes and the responses taken, tied to session and case identifiers, kept for a defined period.

Sources: PCI Security Standards Council, FAQ 1147 on Requirement 8.2.8 (pcisecuritystandards.org). HIPAA Security Rule technical safeguards, 45 CFR 164.312 (ecfr.gov). GDPR Article 4(14) and Article 9 (eur-lex.europa.eu). NIST SP 800-63B-4, Section 5.3 Session Monitoring (pages.nist.gov).

Ideas we learned from: Ann Cavoukian, Privacy by Design: The 7 Foundational Principles, Information and Privacy Commissioner of Ontario (uwaterloo.ca copy).