MindVault Concept: Session Handoff. A different person or process takes over a session that is already signed in. A badge cannot see it happen. Session evidence can.
Physical security and cybersecurity grew up in different departments.
- One team owns badges, doors, and cameras.
- The other owns credentials, endpoints, and logs.
CISA has urged organizations to bring the two together, describing convergence as formal collaboration between security functions that used to work apart. The reason is simple. Attackers do not respect the org chart.
The two worlds meet at a desk. The badge system knows who came through the door. The identity system knows which account logged in. Neither knows who is sitting at the computer right now.
What badge data cannot answer alone
Picture a finance employee who badges out at 6 p.m. At 2 a.m., her workstation is active.
The badge log says she is gone. The session log says she is working. One of them is incomplete. On its own, neither can tell you which.
This is the question we call Operator Continuity: is the person running the session still the person it belongs to? Session evidence answers it with two observations:
- Is the session being run from the keyboard at her desk, or through a remote connection?
- Does the interaction pattern match her, change, or is there not enough evidence to say?
That second observation has a long research trail. In 2000, computer scientists Fabian Monrose and Aviel Rubin published a study showing that typing rhythm alone could tell 63 people apart with roughly 83% to 92% accuracy, depending on the method. They also noted that free, everyday typing was harder to recognize than a set passage. We read work like theirs as a reminder that rhythm is real evidence about who is at the keyboard, and never proof on its own.
Put those next to the badge record and the picture sharpens fast:
- Badged out. Local. Pattern does not match. Someone may be physically at her desk. That is a facilities and security question, right now.
- Badged in. Remote. Pattern does not match. Someone else may be driving her machine while she sits in a meeting.
- Badged out. Remote. Pattern matches. She is most likely working from home. Close it and move on.
- Badged in. Local. Pattern matches. The boring case. Most cases.
- Badge or session data missing. Mark it as a gap and look for another record. Missing data is not suspicious on its own.
Even then, check the simple explanations first. Badge readers miss people who follow a coworker through the door. Scheduled jobs keep machines busy at night. IT may have an approved remote support window. Correlation gives the analyst a sharper question and a time window. It does not hand down a verdict.
Where the correlation happens
This does not need new hardware or a merged department.
- MindVault sends its Human Confidence Signal to the security tools a team already runs.
- It can tell whether a session is being run locally or through a remote connection.
- Most organizations already send badge events to the same SIEM, or can.
A rule that compares the two is a small piece of work with an outsized payoff. The decision stays inside the customer's own policy.
Where this has limits
Two limits matter.
Presence data is personal data. Combining it with session evidence makes it more revealing. Badge-plus-session correlation belongs in the same privacy review as any monitoring program, with a clear rule: security only, never attendance tracking.
Some attacks never touch the desk. In 2022, Microsoft reported a phishing campaign that targeted more than 10,000 organizations. A fake sign-in page sat between victims and the real one, captured their session cookies, and let attackers skip sign-in even with MFA turned on. In an attack like that, the employee's desk and badge record both look normal, because the attack runs somewhere else.
That kind of replay shows up in identity provider and network evidence, as we explained in When a Valid Session Changes Hands. Badge correlation is strongest for what happens at, or through, the employee's own machine.
Start with one rule
Pick the group where an after-hours session matters most, like finance approvers or system administrators. Then write one rule:
A session active while its owner is badged out, with confidence dropping, goes to an analyst.
Watch how often it fires and what it finds. That small test will tell you more than any vendor promise.
The unattended desk is one of the six ways a session changes hands that we described in The Operator Problem. Badge data adds one more piece of evidence to that picture.
MFA proves who logged in. MindVault measures who stayed.
Frequently asked questions
Do we need to replace our physical access system?
No. The correlation happens in the tools you already use, usually a SIEM that receives both badge events and session signals.
Can this tell us who is physically at the desk?
No. It can show that the interaction pattern does not match the account owner and whether the session is local or remote. Identifying the person who is actually there is a job for physical security or a follow-up check.
Is it legal to combine badge and behavioral data?
It depends on where you operate and what employees have been told. Treat it as part of your privacy assessment, involve counsel, and keep the use limited to security.
Sources: CISA, Cybersecurity and Physical Security Convergence Action Guide (cisa.gov). Microsoft Threat Intelligence, From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud, July 2022 (microsoft.com). NIST SP 800-63B-4, Section 5.3 Session Monitoring (pages.nist.gov).
Ideas we learned from: Fabian Monrose and Aviel D. Rubin, "Keystroke dynamics as a biometric for authentication," Future Generation Computer Systems 16 (2000) (buffalo.edu copy).