FIDO membership raises the stakes for continuous authentication

At a glance

What this is: Callsign’s move into the FIDO Alliance is framed around continuous authentication, behavioral intelligence, and the gap between login assurance and whole-session trust.

Why it matters: It matters because identity teams increasingly need controls that assess trust after authentication, especially where fraud, passkeys, verified credentials, and AI agent use intersect.

Context

Continuous authentication extends identity assurance beyond the login event and treats trust as a session-level property rather than a one-time check. That matters because modern authentication stacks increasingly rely on passkeys, verified credentials, and delegated access patterns, all of which can be undermined if assurance ends at the front door.

The governance gap is that many identity programmes still measure success at sign-in, while attackers and fraud actors operate across the full session. In that environment, behavioral telemetry, device context, and risk evaluation become part of identity governance, not just fraud detection or UX tuning.

Key questions

Q: How should teams govern authentication when trust can change after login?

A: Treat authentication as a continuous risk decision, not a one-time approval. Define what evidence is strong enough to maintain trust, when to step up authentication, and when to end the session. That approach matters most where fraud, account takeover, or delegated access can alter the risk state after the initial sign-in.

Q: Why do passkeys not solve session takeover and fraud by themselves?

A: Passkeys reduce phishing and credential theft, but they do not stop an attacker who already has a valid session, compromised device, or abuse path after login. The residual risk shifts from secret capture to runtime trust, so teams still need context signals and policy decisions after authentication.

Q: What are the signs that continuous authentication is being misused as a black box score?

A: If risk scores change user access without clear thresholds, appeal paths, or documented signals, the control is too opaque to govern. Teams should be able to explain which behavioural or device signals matter, when they trigger action, and how exceptions are handled across business-critical journeys.

Q: What should organisations do when AI agents need authentication policies of their own?

A: Create separate rules for AI agents, because agent activity does not map cleanly onto human session assumptions. Define delegation boundaries, permitted actions, and reauthentication or approval points for higher-risk operations so autonomous behaviour is not governed by human-user defaults.

Technical breakdown

Why login-only assurance is no longer enough

Traditional authentication establishes an identity at a point in time, then often assumes the session remains trustworthy until logout or timeout. Continuous authentication changes that model by reassessing signals during the session, including device posture, location shifts, behavioral patterns, and anomalous access timing. This matters when fraudsters can take over a legitimate session after the initial check, or when a valid credential no longer proves the current user is still the same person. In identity governance terms, the control boundary moves from initial authentication to ongoing assurance.

Practical implication: treat authentication as a runtime control, not a gate at entry.

Behavioral intelligence as a trust signal

Behavioral intelligence uses passive signals such as interaction rhythm, navigation patterns, device consistency, and telephony context to build a profile of the genuine user. The value is not that any single signal is definitive, but that multiple weak signals together can expose account takeover, social engineering, or synthetic identity behaviour that a password, passkey, or credential check alone may miss. For IAM teams, this is a governance question about what evidence is acceptable to sustain trust after sign-in, and how to balance assurance with user friction and false positives.

Practical implication: define which post-login signals are authoritative enough to trigger step-up or containment.

Passkeys change the baseline, not the whole problem

Passkeys and verified credentials reduce phishing exposure by replacing reusable secrets with stronger authenticators, but they do not eliminate session abuse, device compromise, or fraud after initial proofing. That is why the standards conversation is widening: the issue is no longer only whether authentication is resistant to credential theft, but whether the identity system can keep validating intent and continuity throughout the session. This is especially relevant where high-value transactions, customer support workflows, or delegated access occur after authentication. In practice, stronger authenticators narrow one attack path while leaving runtime trust decisions open.

Practical implication: pair phishing-resistant authentication with step-up policies for high-risk in-session actions.

NHI Mgmt Group analysis

Continuous authentication is becoming an identity governance requirement, not a fraud add-on. The article points to a market shift in which identity assurance must persist after initial login, especially as passkeys and verified credentials become more common. That moves the control problem from credential strength to session integrity. Practitioners should treat this as a change in governance scope, not simply a new signal feed.

Behavioral intelligence fills a real gap in the trust model, but only if it is governed as an assurance control. Passive signals can reveal account takeover or session drift that static authenticators will miss, yet those signals are probabilistic and context-sensitive. That means programme owners need explicit rules for confidence thresholds, escalation, and exception handling. The practitioner conclusion is that behavioural telemetry must be operationalised through policy, not left as an opaque scoring layer.

FIDO standards and identity verification are converging around the same unresolved question: how much trust survives the login event? This is where the identity bridge becomes important. Passkeys, verified credentials, and AI agent authentication all raise the stakes for proving that the actor remains legitimate over time, not merely at enrolment. For IAM and fraud teams, the next design question is whether assurance is anchored to an event or sustained across the journey.

AI agent authentication will force organisations to separate human identity assumptions from machine identity behaviour. The article’s reference to AI agent authentication is a signal that standards work is moving toward actors that do not behave like users. That matters because session logic built for human interaction does not automatically govern delegated or autonomous activity. Practitioners should expect policy, evidence, and step-up design to diverge for people and agents.

Session-level assurance gap: the real problem is the assumption that a successful login still means a trustworthy actor later in the session. That assumption fails once fraud, account takeover, or delegated access changes the risk state mid-session. Identity programmes should explicitly govern how trust is refreshed, reduced, or revoked after authentication.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Session-level assurance is now a design requirement for identity programmes. As passkeys reduce phishing pressure, the control gap moves to what happens after login. Teams should expect identity governance, fraud detection, and IAM policy to converge around runtime trust decisions rather than authentication events alone.

AI agent authentication will expose how much of today’s identity logic still assumes a human actor. That assumption will not survive long when delegated or autonomous systems need access patterns, approval flows, and trust refresh rules that differ from workforce users. Programme owners should start separating human identity policy from machine and agent policy now.

For practitioners

• Define session-level assurance triggers Map which behavioural, device, location, and transaction signals are strong enough to trigger step-up or session termination in high-risk journeys.
• Separate policy for people and agents Create distinct runtime rules for human users and AI agents so session trust, delegation, and reauthentication thresholds are not treated as equivalent.
• Review passkey coverage against post-login risk Use passkeys to reduce phishing exposure, then test whether your policies still detect session hijack, device compromise, and anomalous in-session actions.
• Document acceptable assurance evidence Specify which signals, scores, and exceptions are valid evidence for sustaining trust after authentication, and which require human review.

Key takeaways

• The article centres on a shift from login-centric authentication to session-level assurance, where trust must be maintained after the initial sign-in.
• Behavioral intelligence matters because it can detect risk that static authenticators miss, including session drift, account takeover, and anomalous in-session activity.
• Identity teams should pair stronger authenticators with runtime policy, clear escalation thresholds, and separate governance for human users and AI agents.

Key terms

• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• Behavioral Intelligence: Behavioral intelligence is the use of session patterns to judge whether an action looks normal for a specific user. In banking, it compares cadence, navigation, pauses, and correction patterns against prior sessions to detect coercion, guidance, or automation that authentication alone cannot reveal.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Session Assurance: Session assurance is the practice of continuously evaluating whether an active digital session still matches the expected identity, device, and behaviour profile. It goes beyond login verification and asks whether the current interaction still deserves to remain trusted before a payment or privilege change is completed.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build programmes that can govern credentials, sessions, and delegated access with clearer control boundaries.