Security teams detect sustained client engagement by identifying long-lived, repeated interaction between a client and a service that exceeds normal user or machine behaviour. Correlate request cadence, session duration, and authentication events, then investigate automation, credential abuse, or persistence mechanisms when engagement remains unusually active or consistent over time.
What sustained client engagement looks like in telemetry
sustained client engagement is not just a high request rate. It is a pattern of repeated, long-lived interaction that stays active beyond normal browsing or batch-job behaviour. The signal usually appears as consistent cadence, persistent sessions, stable authentication context, and a client that keeps returning to the same service or API surface over time.
The important distinction is between bursty activity and durable engagement. A healthy client may create short spikes, but sustained engagement tends to leave a time-series signature: regular requests, limited idle gaps, and continued use of the same token, certificate, or session until something changes in the client or service relationship.
For detection engineering, that means you should look for patterns that survive simple rate thresholds. A client can stay under per-minute limits while still showing persistent, machine-like interaction for hours or days, especially when retries, keepalives, or scheduled automation smooth out the traffic.
Which signals best separate normal use from persistence or abuse?
The strongest signals are correlation signals, not single-event alerts. Request cadence, session lifetime, renewal behaviour, source stability, and authentication reuse tell a better story together than any one field alone. A client that repeatedly authenticates, refreshes tokens, and maintains a predictable interaction pattern may be doing legitimate work, but the same pattern can also indicate automation or credential abuse.
Investigators should also compare the engagement pattern against expected client purpose. A human-driven client usually shows variability in timing, navigation, and endpoint choice. A machine or compromised identity often shows tighter regularity, broader reach than expected, or continuity that persists across reboots, job windows, or token refresh cycles.
When the pattern is unusually consistent, treat it as a lead for deeper review rather than proof of maliciousness. The goal is to determine whether the client is performing authorised automation, using a stolen secret, or maintaining access through a persistence mechanism that normal operational baselines would miss.
How should teams investigate a persistent client pattern?
Start by reconstructing the client’s behaviour over time, then compare it with the identity, application, and infrastructure context around it. That means reviewing authentication history, session duration, token renewal cadence, source IP or workload origin, and the set of resources accessed. A client that remains active across unusual time windows or from an unexpected network path deserves particular attention.
It is also useful to ask whether the client is behaving like a known automation flow or like a compromised actor trying to blend in. Legitimate automation often has a narrow purpose, a bounded resource set, and a predictable renewal cycle. Abuse cases are more likely to show broader access, repeated failures followed by success, or continuity after changes that should have ended the session.
Where the pattern points to long-lived machine access, read the activity alongside RFC 6749: The OAuth 2.0 Authorization Framework and RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens so you can distinguish normal client authentication from access that is too durable to trust by default.
Risk and Threat Considerations
Sustained client engagement can be a sign of legitimate automation, but it can also reveal credential theft, session hijacking, or persistence that keeps a client looking “normal” for long enough to evade simple detection. The risk rises when the same secret, token, or certificate can keep re-establishing access without meaningful re-verification.
Failure mechanism: An attacker or abused automation preserves access through repeated authentication, token refresh, or certificate-backed continuity, which keeps activity alive even when a single login looks ordinary.
Impact: Teams may miss early compromise, allow prolonged access to sensitive systems, and undercount the blast radius because the engagement appears routine rather than exceptional.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Persistent client engagement often reflects reused credentials or tokens. |
| Recommendation — Correlate durable access patterns with valid-account abuse and investigate anomalous authentication reuse. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Sustained engagement detection depends on correlating audit and auth events over time. |
| IA-5 — Authenticator Management | Long-lived client engagement often hinges on secret and token lifecycle weaknesses. | |
| IA-9 — Service Identification and Authentication | Client engagement across services is tied to machine-to-machine authentication behaviour. | |
| Recommendation — Review correlated audit trails to distinguish normal automation from persistent access abuse. Enforce authenticator lifecycle controls to limit durable client access paths. Authenticate service clients with controls that make long-lived access observable and bounded. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Persistent engagement can indicate excessive or uncontrolled client access. |
| Recommendation — Constrain client access paths and review long-lived authorisations for drift. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Sustained engagement is often enabled by secrets that live long enough to mask abuse. |
| Recommendation — Rotate long-lived secrets before they become a durable access channel. | ||
Practitioner Guidance
What to verify: Validate whether the client’s cadence, session age, and authentication renewal fit a known workload pattern, not just whether the traffic volume is high. If the engagement is stable but unexplained, check whether the identity behind it should ever maintain that level of continuity.
Decision rule: If sustained engagement depends on a long-lived secret or a token that repeatedly renews without stronger assurance, treat the identity as a higher-priority review item even when the requests themselves are low-risk. The persistence of access matters as much as the payload of each request.
Practitioner takeaway: The key judgement is whether the client is merely active or is sustaining authority over time, because durable authority is what turns “normal-looking” engagement into a detection problem.
Related resources from NHI Mgmt Group
- Guide: DDoS Protection Guide
- How should security teams detect OAuth client ID spoofing in cloud identity logs?
- How should security teams detect account takeover campaigns that abuse legitimate HTTP client tools against Microsoft 365?
- How should security teams detect client-side tampering on web pages before it affects users or transactions?
- How can security teams detect client-side data capture that backend tools miss?