TL;DR: Attackers are increasingly bypassing MFA by stealing session cookies, then operating inside authenticated sessions where most identity programs lose visibility, according to Expel's analysis of a video interview with Jason Rebholz. The real gap is not login security alone but post-authentication detection, least-privilege drift, and the growing governance burden of non-human identities and AI agents.
At a glance
What this is: This is an analysis of post-authentication identity risk, centred on session cookie theft, weak post-login visibility, and the growing governance burden of non-human identities.
Why it matters: IAM, IGA, PAM, and NHI teams need to shift from login-centric controls to session-level monitoring and lifecycle governance because attackers increasingly operate after authentication succeeds.
Context
Most identity programmes still concentrate control at the authentication checkpoint, but that is only the start of the risk surface. Once a session begins, visibility often fragments across SaaS tools, and attackers exploit that gap by reusing valid sessions instead of challenging the login flow.
For identity governance, this creates a practical timing problem. Human access reviews, NHI lifecycle controls, and post-login monitoring are often designed as separate workstreams, even though the attack path now spans all three. The article argues that identity security has to be treated as continuous action rather than a one-time gate.
Key questions
Q: What breaks when security teams only monitor the login event?
A: They miss the point where the attack actually succeeds. Once a session token, cookie or assertion is stolen, the attacker can act as a trusted user without generating another login failure. Login-only monitoring does not see replay, scope drift or permission manipulation, so the control boundary is already too early.
A: Stolen credentials are valuable because they can grant direct access without a fresh login, especially when active session cookies bypass multi factor authentication. Once attackers authenticate as a real user, they can steal funds, impersonate the victim, or pivot into internal systems. That makes identity theft a scalable enabler for fraud, ransomware, and account takeover.
Q: What are the signs that least privilege controls are failing?
A: Common signs include dormant accounts that still authenticate, users retaining access after role changes, contractors keeping old credentials, and service accounts with broader access than the task requires. Those signals usually mean entitlement drift is outpacing governance.
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
Technical breakdown
Session cookie theft bypasses MFA by reusing trust
A session cookie is the token issued after successful authentication, and it often functions like a temporary pass that does not require the attacker to know the original password or satisfy MFA again. If malware or an adversary-in-the-middle flow steals that cookie, the attacker can import it into their own browser and inherit the authenticated state. The critical point is that the trust decision has already been made, so front-door controls are no longer in the path. This is why login hardening and post-login containment solve different problems.
Practical implication: monitor for session replay and token theft, not just failed logins.
Why post-authentication visibility disappears across SaaS estates
Modern identity stacks often stop at single sign-on events, while the meaningful actions happen inside downstream SaaS applications. That creates an observability break between authentication and activity, especially where logging is inconsistent or distributed across many platforms. The article describes this as a kludgy reconstruction problem: teams must pull logs from multiple tools after the fact and try to rebuild what happened. That is not just an investigation challenge, it is a control gap because detection arrives after the attacker has already operated inside the session.
Practical implication: correlate application logs with identity telemetry before you need them in an investigation.
Least privilege fails when entitlement sprawl becomes the norm
Least privilege is straightforward in theory but fragile in practice because real environments accumulate exception paths, manual approvals, and application silos. The article notes that many organisations cannot even tie large parts of their SaaS estate into SSO, which means access governance is incomplete before privilege reviews even begin. When entitlements are broad, stale, or hard to enumerate, attackers who inherit a valid session can move laterally within the bounds of existing permission drift. The problem is not the principle of least privilege but the operational incompleteness of its enforcement.
Practical implication: treat entitlement drift and incomplete SaaS integration as direct exposure, not administrative noise.
Threat narrative
Attacker objective: The attacker wants to inherit legitimate session trust so they can operate inside the environment without re-authentication and avoid front-door detection.
- Entry occurs when an info stealer, phishing lure, or compromised download captures session cookies or related credentials from the endpoint.
- Credential reuse follows when the attacker imports the stolen cookie into their own browser and takes over an active authenticated session without triggering a fresh MFA challenge.
- Escalation happens inside the session as the attacker uses the victim's existing SaaS permissions to access data, pull files, and move through connected applications.
- Impact is achieved when the attacker operates as the legitimate user long enough to exfiltrate information or stage further access across the environment.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Post-authentication identity risk is now the real control boundary: the industry over-invested in login assurance and under-invested in what happens after authentication succeeds. That is not a visibility inconvenience, it is a structural failure of the identity model. Once an attacker can operate inside a trusted session, the relevant control plane shifts from the login event to the session itself, and practitioners must recognise that as the primary security boundary.
Session replay exposes a governance assumption that no longer holds: access review processes were designed for privileges that persist long enough to be observed, evaluated, and recertified. Session-cookie theft collapses that assumption because the attacker can act before the review cycle even notices a state change. The implication is not simply better tooling, but a redefinition of where governance can realistically see and control risk.
Least privilege has become an execution problem, not a policy slogan: the article shows that manual entitlements, incomplete SaaS integration, and approval fatigue create a permissions surface attackers can exploit after login. That makes least privilege useful only when it is continuously enforced across the applications where work actually happens. Practitioners should treat incomplete coverage as a control failure, not a maturity milestone.
Non-human identities are turning post-authentication blind spots into delegation risk: service accounts, tokens, and AI agents expand the number of identities that can inherit or exercise trust after initial access. This is where the next governance problem emerges: not just who authenticated, but which machine or agent can continue operating once trust has been granted. The field needs to move from static entitlement management to lifecycle control over every actor that can act inside a session.
Least autonomy will matter alongside least privilege as autonomous systems scale: the article's warning about AI agents is directionally correct because autonomous behaviour changes the governance question from access scope to action scope. The industry does not yet have a stable control vocabulary for how much independent action an agent should be allowed to take after it is trusted. Practitioners should assume that the next identity gap will be measured by what the actor can decide to do, not only by what it can access.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Research and Survey Results
What this signals
Identity programmes need a post-authentication operating model: login assurance still matters, but it no longer answers the question that attackers exploit. Security teams should expect the next breach to occur inside a valid session, where token reuse, application sprawl, and inconsistent logs make detection harder than prevention.
Least privilege is becoming a visibility problem as much as a permissions problem: organisations cannot govern what they cannot see, and the control failure often begins with incomplete SaaS coverage. The Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is exactly the kind of entitlement drift attackers benefit from once they inherit a live session.
For practitioners
- Instrument session-level detection Correlate identity events with application activity so investigators can see what happened after authentication, not just whether the login succeeded.
- Map SaaS blind spots Inventory applications that sit outside SSO or have incomplete logging, then classify them as identity visibility gaps rather than isolated app issues.
- Tighten entitlement scope Review where broad or manually approved access still exists, especially in business apps where stolen sessions can exercise normal user rights.
- Build NHI lifecycle ownership Assign clear ownership for service accounts, tokens, and other non-human identities so their permissions, offboarding, and review cycles are explicit.
- Define agent action boundaries Set explicit limits on what autonomous systems may do after they authenticate, including the actions they can initiate without human intervention.
Key takeaways
- Attackers are increasingly winning after authentication, not before it, because session cookies and valid sessions let them bypass the login checkpoint.
- Visibility breaks between SSO and downstream SaaS activity are now a core identity control gap, not an investigation inconvenience.
- Teams need session-level monitoring, tighter entitlement scope, and explicit governance for non-human identities if they want to reduce post-authentication risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Session cookies and token theft are the article's core post-authentication abuse path. |
| NHI-05 — Overprivileged NHI | The article ties post-login abuse to broad permissions and incomplete entitlement governance. | |
| NHI-10 — Human Use of NHI | The article highlights service accounts, tokens, and AI agents as governed actors behind user-facing access. | |
| Recommendation — Scan for exposed session material and revoke any reusable token discovered in logs or endpoints. Reduce effective access scope across service and application identities before stolen sessions can exploit it. Separate human and non-human trust paths so machine identities are owned, reviewed, and offboarded explicitly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about permissions that remain usable after authentication succeeds. |
| Recommendation — Continuously validate access permissions and remove standing entitlement that exceeds actual business need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes cookie theft followed by movement inside authenticated environments. |
| Recommendation — Map stolen-session activity to credential access and lateral movement detections to improve response coverage. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Session cookies and identity tokens are authenticators whose lifecycle must be governed. |
| Recommendation — Apply authenticator lifecycle controls to limit how long stolen or stale session material remains usable. | ||
Key terms
- Session Cookie Theft: The capture of browser session data that proves an already authenticated user. Once stolen, the cookie can let an attacker impersonate the victim without repeating the login step, which makes session assurance and replay resistance critical to identity security.
- Post-Authentication Visibility: Post-authentication visibility is the ability to observe what an identity does after it has successfully logged in or received a token. It is the difference between knowing access was granted and knowing whether that access is being used safely, unusually, or maliciously.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Non-Human Identity Lifecycle: The Non-Human Identity Lifecycle is the full sequence of creation, use, control, review, and retirement for identities that are not tied to a person. It covers service accounts, API keys, certificates, tokens, bots, and AI agents, including issuance, rotation, monitoring, revocation, and secure decommissioning across systems and environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org