Post-authentication identity risk is where attackers win today

At a glance

What this is: This is an independent analysis of how session hijacking, post-authentication blind spots, and NHI growth are reshaping identity security priorities.

Why it matters: It matters because IAM, IGA, PAM, and security teams must govern what happens after authentication, not just at the login checkpoint, across human users, service accounts, and emerging AI agents.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read Expel's analysis of session hijacking and post-authentication identity risk

Context

Post-authentication identity risk is the point where security programmes often lose the plot. Organisations spend heavily on SSO, MFA, and login anomaly detection, then assume the problem is largely solved once a session is established. That assumption fails when attackers use stolen cookies or credentials to act inside trusted sessions without re-authenticating.

For identity security teams, the real challenge is continuous visibility across the session, the application stack, and the non-human identities that increasingly sit behind business workflows. The article frames this as a timing problem as much as a control problem, because attackers are exploiting the gap between successful authentication and meaningful monitoring.

That gap is already visible in modern SaaS-heavy environments, where access, logs, and entitlements are fragmented across many systems. The starting point described in the source is not unusual; it reflects a common enterprise pattern in which front-door controls are mature, but post-authentication governance remains incomplete.

Key questions

Q: What breaks when security teams rely only on MFA and login controls?

A: The control set stops at authentication, but attackers do not. Once a session cookie or token is stolen, the adversary can inherit an already-approved session and operate without triggering another login challenge. That is why post-authentication telemetry, session anomaly detection, and application-level logging are essential to identity defence.

Q: Why do session hijacking attacks remain effective in SaaS environments?

A: SaaS environments fragment activity across many tools, so a valid session can move through applications without a single unified security checkpoint. Attackers exploit that fragmentation by reusing trusted sessions and blending into normal user behaviour. The risk rises when identity teams can see authentication but not what happens after it.

Q: What do organisations get wrong about least privilege in access control?

A: Many teams treat least privilege as a provisioning rule instead of a living authorization outcome. They grant access correctly at the start, but fail to revisit whether the identity still needs it, whether context has changed, or whether the privilege can be narrowed during the session. That is where the control usually breaks down.

Q: Who should be accountable for AI identity governance?

A: Accountability should sit with the team that owns the workflow and the team that owns identity controls, because AI access crosses both domains. Security, platform, and application owners each hold part of the lifecycle, but one business owner must remain responsible for the access decision and its removal.

Technical breakdown

Why stolen session cookies bypass MFA and login controls

A session cookie is the token issued after a user authenticates successfully. If an attacker steals it through info-stealer malware, phishing, or an adversary-in-the-middle flow, they can replay that cookie and inherit the active session without needing the password or the MFA challenge. In practice, the identity provider sees a valid session, not a new login event. That means many traditional login controls never fire, because the attacker is not breaking authentication. They are reusing trust that was already granted.

Practical implication: monitor for session replay and token misuse, not just failed logins or MFA fatigue events.

Why post-authentication visibility matters more than the front door

Most identity tools are strongest at the moment of authentication and weakest immediately after it. In SaaS environments, the meaningful risk sits in what the session does next: file access, exports, privilege changes, application hopping, and lateral movement across tools. If logs are isolated in each application, investigators have to reconstruct the session manually, which slows response and leaves gaps. The architecture is effectively event-based at login and fragmented everywhere else.

Practical implication: centralise application-level activity logs before an incident forces teams to piece together partial evidence.

How non-human identities expand the governance problem

Non-human identities include service accounts, API keys, OAuth tokens, certificates, and AI agents. They outnumber human accounts in many environments and are often granted broad, persistent access because lifecycle controls are immature. As automation and agentic systems grow, the number of identities to govern rises faster than manual review processes can handle. Least privilege becomes harder to define when the subject is not a person with fixed job duties but a machine or agent with changing runtime behaviour.

Practical implication: extend identity governance, entitlement review, and offboarding processes to machine and agent identities, not just human users.

Threat narrative

Attacker objective: The attacker wants to inherit trusted access and move inside the environment without needing to defeat MFA or visibly compromise the account again.

1. Entry occurs when malware, phishing, or a compromised download harvests credentials and session cookies from an endpoint.
2. Escalation happens when the attacker replays the stolen session cookie and operates as the legitimate user inside the trusted session.
3. Impact follows through application access, data export, and lateral movement across SaaS tools without triggering a fresh authentication event.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Post-authentication blindness is the governing failure, not weak login security. The industry has over-invested in the front door and under-invested in what happens after authentication succeeds. That creates a false sense of closure around identity risk, because the attacker now lives inside a valid session. The implication is that identity programmes must be judged on continuous visibility, not login hardening alone.

Least privilege at scale breaks when access review is manual and incomplete. Rebholz describes the practical reality: access decisions accumulate through manager approvals, role drift, and SaaS exceptions until the blast radius becomes unpredictable. This is a governance problem, not just an entitlement problem. The lesson for practitioners is that least privilege is only meaningful when entitlement drift is measured and corrected continuously.

Least autonomy is becoming the more useful control concept for AI agents. AI agents and other non-human identities do not just add more accounts, they introduce systems that can choose actions at runtime and interact with other agents. That means the old assumption that privilege can be fully defined at provisioning time starts to fail. The implication is that governance must shift from static permissioning to runtime constraint design.

Identity governance must span human users, service accounts, and AI agents as one lifecycle discipline. Offboarding, recertification, and privileged access review are usually treated as separate programmes depending on the identity subject. In reality, the same governance intent applies across all three, but the evidence and cadence differ. Practitioners should stop treating machine identity as a side topic and start managing it as core identity estate.

Visibility gaps become attack multipliers once SaaS and non-human identity sprawl converge. When every application keeps its own logs and every automation layer introduces another credential, incident response loses both speed and completeness. The result is not just more work for investigators. It is a structurally larger trust surface, which is why identity telemetry and entitlement hygiene now belong in the same operating model.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how remediation lag keeps exposure alive after discovery.
• Ultimate Guide to NHIs , Key Challenges and Risks shows why visibility gaps, over-privilege, and secret sprawl continue to outpace manual controls.

What this signals

Identity security is moving from authentication governance to session governance. The practical shift is toward collecting application-level telemetry, correlating identity activity across SaaS, and using NIST SP 800-53 Rev 5 Security and Privacy Controls to anchor auditability and access control. The control objective is no longer to prove a login happened, but to show what the session did afterward.

Least autonomy is now a design question for AI-enabled identity estates. As agents, service accounts, and tokens proliferate, teams need to separate stable human access from machine runtime behaviour and watch how delegated actions propagate through the environment. The cleaner the lifecycle inventory, the faster teams can spot when identity trust has outgrown the governance model.

Session telemetry and identity lifecycle controls belong in the same operating rhythm. A useful internal reference point is the Ultimate Guide to NHIs, because the same governance gaps that leave service accounts invisible also leave machine and agent identities poorly owned.

For practitioners

• Instrument session-level detection across SaaS apps Collect application logs before the incident, then correlate file access, exports, privilege changes, and unusual application hopping into one identity timeline. This is the only way to see what happens after the authentication event.
• Treat cookie replay as an identity threat model Add detections for impossible session reuse, token replay, and anomalous browser or device patterns that indicate a stolen session rather than a failed login. Review whether MFA success is being treated as a stop condition when it should only be a checkpoint.
• Map and govern non-human identities as first-class assets Inventory service accounts, API keys, tokens, and AI agent identities together, then assign owners, scope, and offboarding triggers so they are visible in the same control plane as human access.
• Reduce entitlement drift through continuous recertification Replace annual access reviews with higher-frequency checks for privileged accounts, high-risk SaaS apps, and dormant credentials that still hold access long after business need has ended.

Key takeaways

• The central failure is post-authentication blindness, where security teams see the login but miss the activity that follows.
• The scale of the problem is already visible in NHI governance data, with service-account visibility still effectively absent in most organisations.
• Practitioners should move from login-centric controls to session telemetry, entitlement drift management, and first-class NHI governance.

Key terms

• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Post-Authentication Visibility: Post-authentication visibility is the ability to observe what an identity does after it has successfully logged in or received a token. It is the difference between knowing access was granted and knowing whether that access is being used safely, unusually, or maliciously.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Least Autonomy: Least autonomy is the principle of limiting how much independent decision-making a non-human actor can exercise before external re-evaluation. It extends least privilege by addressing action chaining, delegation, and self-directed execution, which matter when the identity is an AI agent rather than a human user.

What's in the full article

Expel's full blog covers the interview detail this post intentionally leaves for the source:

• The interview transcript and direct commentary from Jason Rebholz on why attackers prefer session theft over brute-force login attacks.
• The concrete examples he gives for post-authentication blind spots across SaaS applications and investigation workflows.
• The discussion of non-human identities and why agent-to-agent trust chains are becoming an identity governance problem.
• The original video interview that provides the full context behind the article's claims.

👉 Expel's full blog includes the interview context, attacker tradecraft, and the NHI implications behind the session risk discussion.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.