MindVault Concept: Evaluation by Evidence. Judging session monitoring technology by the evidence it evaluates, the question that evidence answers, and its behavior when confidence is wrong, rather than by labels like continuous, AI powered, or behavioral.
Session monitoring has entered the identity conversation, NIST now defines it, and vendors have noticed. Many products can say continuous, many can say AI, many can say behavior, and none of those words tells a CISO what the system can actually see. Here are the twelve questions that do, and MindVault expects to be measured against every one of them.
The twelve
1. What exact security problem do you solve? Ask the vendor to finish the sentence: our product determines whether. Identity risk, device risk, fraud risk, session validity, and operator continuity are different answers. A product claiming all of them from one signal deserves scrutiny.
2. What is the unit you evaluate? The account, the device, the browser, the person, the session, the transaction, and the agent are different units, and a risk score means nothing until you know which one it scores.
3. What evidence contributes to the decision? Behavioral interaction, device posture, network context, identity events, token provenance, endpoint processes. A vendor who can name evidence categories without exposing algorithms understands their own boundaries.
4. What happens when evidence is missing? A new device or a telemetry gap is insufficient evidence, not hostile evidence. Systems that cannot tell the difference punish legitimate users for their own blind spots.
5. How do you handle normal human change? New keyboards, travel, fatigue, injuries, accessibility tools. A model that treats all change as hostile trains the organization to ignore it.
6. Which takeover scenarios have you actually tested? Token replay, remote control, human handoff, shared devices, automation, and mimicry are mechanically different. Do not accept account takeover as one category.
7. How does the system respond to uncertainty? Look for a ladder, observe, notify, step up, restrict, terminate, not a switch.
8. What are your false positive and false negative rates, and how were they measured? Demand methodology: users, sessions, environments, duration, attack simulations, and what the product failed to catch. A vendor willing to discuss failure conditions is more credible than one promising perfection.
9. What content do you collect? Do not settle for privacy safe. Ask directly about typed content, passwords, screenshots, clipboard, retention, and access. Privacy claims should be as testable as security claims.
10. What happens on the endpoint versus the cloud? This decides performance, privacy, governance, and what still works when connectivity drops.
11. How does the signal integrate with what we already own? The valuable architecture is evidence inside the tools you trust, identity policy, SOC, SIEM, SOAR, not another isolated console.
12. What should we never claim your product can detect? The most important question on the list. Every security product has boundaries, and the correct answer to some scenarios is no. That is not weakness. That is the vendor telling you the truth.
The principle
The goal of session monitoring is not another score nobody understands. It is a better decision: what evidence changed, how much confidence changed, why it matters, and what should happen next. A company asking the industry to adopt a new standard should hold itself to it first, so bring this list to every vendor in the category, including us.
MFA proves who logged in. MindVault proves who stayed.
Frequently asked questions
What is the most revealing question of the twelve? The last one. Vendors who can name what they cannot detect understand their own system. Vendors who cannot are selling a label.
Should accuracy numbers disqualify a vendor? Headline numbers without methodology should. Ask how they were produced, on how many users and sessions, against which simulated attacks, and what was missed.
Do these questions apply to MindVault? All twelve, and the honest answers include boundaries. Publishing the list is the commitment to keep answering it.
Sources: NIST SP 800-63B-4, Section 5.3 (pages.nist.gov).