Every identity control in the modern stack answers one question: who logged in. The operator problem is the question nobody assigned an owner: who is operating the session right now? Those are different questions, and the gap between them is where a growing share of real attacks live.
An account and its operator are supposed to be the same thing. Authentication is the ceremony that binds them: the person proved who they were, so the session belongs to them. The binding, though, is checked exactly once. Everything afterward runs on the assumption that it still holds.
Six ways the binding breaks without a login event
A stolen session cookie. Infostealer malware lifts the browser's authentication cookies. Loaded into another machine, they resume the session in full. There is no login to challenge, because from the system's point of view the login already happened. The account is present. The operator was never there.
An adversary-in-the-middle proxy. The user completes a real login on what looks like the real page, including MFA. The proxy in the middle keeps the resulting session token. One authentication ceremony, two operators.
A remote-control takeover. Remote monitoring and management software, the same class of tool help desks use legitimately, gets installed on an employee's machine by an attacker. The employee authenticated at nine. Someone else took the wheel at two. The identity system logged nothing at two, because nothing it watches for occurred.
An unattended or shared workstation. A session left open in a branch office, a badge-in colleague finishing a task on someone else's machine, a credential lent under deadline pressure. Common, mundane, and invisible: the session record shows one continuous operator who was, in reality, several.
A pressured or impersonated user. Internal impersonation is a live problem even in small companies: messages that appear to come from an executive's account directing a new hire to act. When the attacker goes further and operates the executive's session directly, the account behaves like the executive in every log. The behavior at the keyboard is the only place the truth still shows.
A machine instead of a person. Scripts, automation, and increasingly AI agents operate sessions that were issued to humans. Sometimes that is sanctioned delegation. Sometimes it is the attack itself. Either way, the operator is no longer the enrolled human, and the session record does not say so.
Notice what these six share. No password was cracked. No MFA was defeated in the moment that mattered. Several involve no authentication event at all. Verizon's Data Breach Investigations Report keeps finding the human element in roughly six in ten breaches, and abuse of valid credentials and sessions is a leading way in. The controls are not failing at their jobs. Their jobs end at login.
Operator Continuity
Authentication verifies who started the session. Operator Continuity verifies who is operating it now.
Operator Continuity is the property a session has when the entity behind it, moment to moment, is still the entity the session was issued to. It is not a product feature name so much as the thing your identity program silently assumes and never measures. Once it has a name, the audit question becomes obvious: for your most sensitive sessions, what evidence do you have of Operator Continuity between login and logout? For most organizations today the honest answer is none.
What watching for continuity looks like
Continuity leaves evidence, because people are not interchangeable at the keyboard. Each person types with a rhythm, moves a pointer with a signature of speed and correction, works at a pace, favors certain shortcuts. That pattern is a behavioral persona, and it is stable enough to notice when it changes. A remote operator arrives with different timing. A stolen-cookie session arrives with no behavioral history at all, a token claiming to be a continuation with hands that just showed up. A machine driving the session produces timing no human produces.
None of those observations should trigger a lockout by themselves. Real people have slow mornings, new keyboards, broken wrists. The correct response to falling continuity is a ladder: log it, tell the security team, ask for a step-up check before the wire transfer or the mass export, and reserve hard action for hard evidence. The purpose is visibility first. A security leader who can see continuity dropping in minutes is in a different position than one who reads about it in a forensics report eight months later.
An honest boundary belongs here. Continuity monitoring built on human behavior covers human-operated sessions: takeovers, remote operators, walk-ups, insider handoffs. Sessions abused with no human at the keyboard at all, pure token and API abuse or fully autonomous agents, need a different kind of continuity evidence based on scope and conduct rather than typing rhythm. That is the expansion path, and pretending one signal covers everything is how vendors lose trust. We wrote more about the agent side in AI Agents Need Identity Too.
MindVault builds Operator Continuity into a live score, the Human Confidence Signal, inside the category we call Continuous Identity Confidence.
MFA proves who logged in. MindVault proves who stayed.
Frequently asked questions
What is Operator Continuity? Operator Continuity is the property a session has when the entity operating it, moment to moment, is still the entity it was issued to. Authentication verifies who started the session. Operator Continuity verifies who is operating it now.
How do attackers take over a session after login? The most common paths are stolen session cookies from infostealer malware, adversary-in-the-middle phishing that captures session tokens during a real login, and remote-control tools installed on an already-authenticated machine. None of these require defeating the password or MFA at the moment of takeover.
Does MFA stop session hijacking? No. MFA protects the login event. Session hijacking targets the session token issued after login succeeds, so the attacker inherits a session where MFA has already been satisfied.
How can you tell the operator of a session changed? Changes show up in behavior and provenance: typing rhythm and pointer movement that no longer match the enrolled person, a session transport that switched to a remote channel, a token with no behavioral history behind it, or activity patterns no human produces. Each is evidence; together they are a continuity signal.
Is Operator Continuity the same as continuous authentication? They are related. Continuous authentication usually means periodically re-checking identity factors. Operator Continuity is the outcome being protected: confidence that the same authorized entity is behind the session the whole time, using behavioral and contextual evidence rather than repeated challenges.
Sources: Verizon Data Breach Investigations Report 2025 (verizon.com/dbir). The Hacker News expert insights on session cookie theft (thehackernews.com). CyberArk, lurking threats in post-authentication sessions (cyberark.com). VentureBeat, MFA verifies who logged in (venturebeat.com).