The Session Is Legitimate. The User Is Not.

Every organization that has deployed multi-factor authentication, invested in endpoint detection, or adopted a Zero Trust framework has done so on the basis of a shared assumption: that a successfully authenticated session represents a legitimate user. That assumption is no longer reliable.

The most damaging identity-based attacks in today's threat landscape do not defeat authentication; they bypass it. Adversary-in-the-middle phishing captures session tokens after MFA succeeds. Cookie theft replays valid credentials from attacker infrastructure. Remote access tools let threat actors operate a legitimate session in real time, from anywhere in the world, while the account holder remains unaware. In each case the session is technically valid, the authorization is real, and every existing control has fired correctly, while an attacker operates freely in an environment that has no mechanism to know they are there.

The gap is not a failure of implementation. It is a failure of assumption. The security industry built its identity stack around the authentication event and left the entirety of the post-authentication session unmeasured. Continuous Identity Confidence addresses that gap directly, by learning the behavioral persona of each user, how they type, how they navigate, how they interact with the systems they use every day, and continuously confirming that the entity operating the session still matches it.

Credentials Are No Longer Proof of Identity

The rise of adversary-in-the-middle (AiTM) phishing has fundamentally altered the calculus of identity-based attacks. Where traditional phishing sought to steal a password, AiTM frameworks intercept the authenticated session itself, capturing the token issued after a user completes MFA. The attacker never needs the password and never needs to defeat the second factor. Microsoft's threat intelligence documented a single AiTM campaign that targeted more than 10,000 organizations, and reported a 146% year-over-year rise in these attacks.

Cookie theft operates on the same principle. A single stolen session token, harvested from an endpoint via infostealer malware, grants an attacker an authenticated, authorized session with no authentication required. The identity provider has no visibility into what happens after the token is issued. In the 2024 compromise of Snowflake customer environments, the group tracked as UNC5537 authenticated to roughly 165 organizations using stolen credentials.

The Vectors in ATT&CK Terms

None of these patterns is novel in the abstract. Each maps cleanly to a documented technique in the MITRE ATT&CK framework, and several succeed precisely because they operate after the MFA challenge has already been satisfied.

Every technique in that list resolves, by design, to activity that looks authorized: a valid token, a legitimate tool, an authenticated account. That is exactly why they are so difficult to detect from inside the session.

What Is Actually Missing

The industry has a mature vocabulary for the moment of authentication and a growing vocabulary for the behavior of processes and network traffic. What it lacks is a capability for the continuous confirmation of who, or what, is operating the session. Authenticating a user is a point-in-time event. Confirming a persona is an ongoing one. The attack surface is not the authentication event; it is every minute that follows it.

The security industry's response to identity-based threats has been substantial: multi-factor authentication at scale, single sign-on, identity governance, and Zero Trust as an architectural principle. These investments were not misguided. But they were designed around a specific threat model, one in which the attacker's goal is to defeat authentication. Today's most damaging identity-based attacks assume authentication will succeed and build their strategy around what happens after.

An IAM platform cannot distinguish between a legitimate user accessing a sensitive resource and an attacker operating through that user's hijacked session, because both present the same authenticated identity carrying the same entitlements. User and Entity Behavior Analytics (UEBA) come closest, but they operate at the level of access events over time. They answer what an account did, not who was operating that account in a given session, in real time, at the keyboard level.

Continuous Identity Confidence learns a behavioral persona for each user during normal work: the rhythm of typing, the way a pointer moves, the pace and pattern of navigation. That baseline becomes the reference point for every subsequent session. As long as observed behavior aligns with the established persona, confidence remains high and the session proceeds without interruption.

When behavior drifts, suddenly, gradually, or in patterns consistent with known attack techniques, confidence degrades and the response scales in proportion. Not an instant lockout, but a ladder: observe, notify the security team, step up verification before a sensitive action, and restrict only when the evidence warrants it. The output is a live Human Confidence Signal the security team can act on.

The Dwell-Time Window

Dwell time, the interval between an attacker gaining access and that access being detected, remains one of the most consequential metrics in enterprise security. Mandiant's M-Trends 2024 put global median dwell time at roughly 10 days, but breaches involving stolen or compromised credentials remain the slowest of any category to identify and contain. The reason is structural: when an attacker operates through a legitimate session, they produce no signals existing detection tools are designed to surface. Scoring behavioral alignment as the session unfolds compresses that window from weeks or months to the time it takes behavior to diverge from the persona.

Insider Threat Detection Without Surveillance

The model is not built to record what users do; it characterizes how they do it, and flags when that pattern changes in ways consistent with risk. Security teams get a signal that warrants investigation, employees operate in an environment that monitors for anomaly rather than cataloguing activity, and legal and HR teams have a defensible framework for how the signal was generated.

A Signal That Makes the Existing Stack Smarter

The Human Confidence Signal feeds the tools already in place. It gives IAM, SIEM, and SOAR a new input, whether the entity behind an authenticated request is still the verified human, so existing policies can make better decisions without being replaced.

Continuous Identity Confidence is horizontal infrastructure. It sits beneath industry-specific controls and addresses the human-layer blind spot every organization shares, whether a bank, a logistics company, a law firm, a government contractor, or a technology company committing to production infrastructure. The vertical changes; the exposure does not.

The threat is not exclusive to remote work. The unattended laptop at a coffee shop and the employee who hands a stranger their screen are distributed-workforce problems, but in-office workforces face their own version: the unattended workstation never locked, the shared terminal in an operations center, the social-engineering call that convinces an on-site employee to install a remote support tool.

A definition of a problem is only as credible as its treatment of what makes the problem hard. Continuous Identity Confidence is a probabilistic control operating on noisy human signals, and it introduces real engineering and operational challenges. Naming them is the line between a defensible security control and a marketing claim.

The cold-start problem. A behavioral baseline is only meaningful once there is enough interaction history to characterize an individual. New hires, contractors, infrequent users, and shared or kiosk accounts have little or no established pattern, which forces a design decision with no free answer: during the learning period, does the control fail open or fail closed?

Difficult environments. Remote desktop chains, virtualized and VDI environments, and roaming across devices distort the very timing and movement characteristics the model depends on. A credible approach has to define where it works well, where confidence degrades, and how it avoids disadvantaging legitimate users whose behavior is atypical by necessity.

Privacy and proportionality. Even a content-free model that captures rhythm rather than text raises governance questions: what is retained, for how long, who can query the signal, and what prevents a security control from drifting into productivity surveillance. Legitimacy depends on tight scoping, transparency with the workforce, and a defensible basis for any automated action.

None of this is an argument against Continuous Identity Confidence. These are the terms on which the gap must be closed, and the questions any technical evaluation should put to a solution that claims to close it.

Authentication solved a hard problem. It gave organizations a way to prove, at a moment in time, that a user is who they claim to be. But that proof expires the instant it is granted, and the security industry never built the control that keeps confirming it. The organizations that recognize this shift earliest will be the first to close a gap that, right now, exists silently in every environment that has ever assumed a valid session means a legitimate user.

MFA proves who logged in. MindVault proves who stayed.