Runtime identity risk is the new battleground after login

At a glance

What this is: This analysis argues that post-authentication compromise, not the login screen, is now the main identity risk surface because stolen session artifacts can bypass MFA.

Why it matters: IAM and security teams need to shift controls from one-time authentication checks to continuous runtime monitoring of tokens, sessions and access behaviour.

👉 Read Unosecur's analysis of runtime identity risk after login

Context

Runtime identity risk is the security problem that begins after authentication succeeds and a user, device or browser is already trusted. At that point, the control problem changes from proving identity to proving that the session, token and access pattern still match the original trust decision.

Unosecur's article argues that modern IAM programmes over-focus on the login box while attackers target what happens after it. That gap matters for both workforce and customer identity programmes because session theft, token replay and access drift all occur inside the downstream identity journey.

The practical challenge is that authentication signals are static at issuance, while post-login activity is dynamic. Once possession artifacts such as cookies, SAML assertions or OAuth2 tokens exist, governance has to evaluate whether access is still consistent with the environment, the user and the intended scope.

Key questions

Q: What breaks when security teams only monitor the login event?

A: They miss the point where the attack actually succeeds. Once a session token, cookie or assertion is stolen, the attacker can act as a trusted user without generating another login failure. Login-only monitoring does not see replay, scope drift or permission manipulation, so the control boundary is already too early.

Q: Why do stolen tokens bypass MFA?

A: MFA is checked during login, but a stolen token is already proof that login succeeded. Once an attacker has that token, they can often act as the authenticated user without facing another MFA challenge. That is why session protection and token revocation matter as much as the login flow.

Q: What are the signs that post-authentication identity controls are failing?

A: Look for unusual token reuse, rapid changes in access requests, dormant accounts gaining new permissions, account recovery changes and device or platform shifts that do not fit the original login context. Those signals show that the session is still active but no longer trustworthy.

Q: How should teams respond when an authenticated session looks compromised?

A: Contain the session first by revoking or invalidating the token, then compare current behaviour against prior access history to determine whether the identity has drifted. Response should focus on limiting further use of the trusted session, because the attacker may already be operating inside the access boundary.

Technical breakdown

Why session artifacts become the real control point

After authentication, the identity system issues possession artifacts such as OAuth2 access tokens, SAML assertions, OIDC id tokens and browser cookies. These artifacts become the proof of trust for downstream systems, so whoever holds them can often act as the authenticated user without touching the login flow again. That is why browser malware, adversary-in-the-middle attacks, XSS and local storage theft are so effective: they target the artifact, not the password. In practice, the session becomes the credential. Practical implication: treat session binding, token scope and runtime revalidation as first-class controls, not as secondary logging concerns.

Practical implication: treat session binding, token scope and runtime revalidation as first-class controls, not as secondary logging concerns.

How post-authentication abuse evades MFA and login-centric detection

MFA reduces risk at authentication, but it does not govern what happens after a valid session exists. If an attacker steals a token or cookie, they inherit the trust already granted by the original login, which means authentication monitoring may see nothing unusual. The article's MITRE ATT&CK examples, including valid accounts, account manipulation and access token manipulation, all share that property. They operate under a legitimate identity context, so the signal is in behaviour, not login success. Practical implication: build detection around access drift, unusual scope expansion and session reuse patterns rather than only failed or suspicious logins.

Practical implication: build detection around access drift, unusual scope expansion and session reuse patterns rather than only failed or suspicious logins.

Why runtime identity needs a unified identity fabric

A unified identity fabric is the idea that registration, authentication, authorization, session issuance and behavioural monitoring are one continuous control plane rather than separate tools. That matters because attackers pivot to the weakest stage in the chain, and the article argues that many IAM programmes still stop at login. Once access is granted, comparison against device context, historical access, known TTPs and statistically unusual behaviour becomes the real governance layer. Practical implication: design identity telemetry so post-login signals can be correlated with policy and access history in the same decision path.

Practical implication: design identity telemetry so post-login signals can be correlated with policy and access history in the same decision path.

Threat narrative

Attacker objective: The attacker wants to bypass authentication controls and operate under a legitimate session to expand access, manipulate permissions and reach sensitive systems or data.

1. Entry occurs after a valid login when the attacker steals a session token, cookie or other possession artifact from browser storage, malware, or an adversary-in-the-middle flow.
2. Credential abuse follows when the stolen artifact is replayed to inherit the authenticated user's trust without interacting with MFA or the login screen again.
3. Escalation happens when the attacker uses valid access to manipulate permissions, create new accounts or expand scope through downstream identity and authorization paths.
4. Impact is achieved through lateral movement, data access, or repeated access using long-lived tokens and reactivated accounts that remain trusted by downstream systems.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime identity risk is a governance problem, not just a detection problem. The article shows that the real control boundary moves after authentication, when tokens, cookies and consent artifacts begin to carry trust downstream. That means IAM programmes that still treat login as the primary security event are governing the wrong layer. The practitioner conclusion is that runtime behaviour now has to be treated as part of identity assurance.

Session artifacts are the new possession boundary. OAuth2 access tokens, SAML assertions, OIDC id tokens and web cookies are not just technical by-products of login. They are the operational proof that downstream systems trust the session. Once those artifacts are stolen or replayed, MFA strength no longer matters for that transaction path, which is why possession-bound trust must be governed as carefully as credentials.

Post-login identity attacks expose the limits of event-based IAM. The article's examples of access token manipulation, valid accounts and account manipulation all point to the same reality: many compromises happen inside authorized contexts. Detection that waits for authentication failures will miss the attack path, so identity security has to move toward continuous context comparison and behavioural deviation.

Identity programmes need a runtime governance layer, not a stronger login story. The industry has spent years hardening the front door, but adversaries now work inside the building. That shifts the discipline from proving who logged in to proving whether the session still deserves the access it holds. Practitioners should read this as a structural change in IAM architecture, not a tuning exercise.

Post-authentication drift is the named concept this article makes visible. Drift begins when the original trust decision and the current access reality no longer match, whether through token reuse, device change or unusual privilege behaviour. That concept is more useful than a generic session-hijack label because it captures the governance failure mode across workforce and customer identity alike. The implication is that continuous trust assessment has become mandatory.

What this signals

Post-authentication compromise is now a governance boundary. Teams that only harden login will continue to miss the attacker activity that happens after trust has already been issued. The practical shift is to make runtime comparison between issued access and observed behaviour part of the identity control model.

Runtime identity risk expands the scope of identity security beyond workforce sign-in. The same session and token issues apply across customer, partner and internal environments, which means IAM, IGA and detection teams need a shared view of post-login trust rather than separate point controls.

Continuous context checking is the new baseline. When a session can be stolen, replayed or reused without another authentication prompt, the security programme has to evaluate device, location, access pattern and token lifetime as one decision set.

For practitioners

• Instrument post-login session monitoring Correlate token issuance, cookie use, device context and access history so the SOC can distinguish normal authenticated use from suspicious runtime behaviour.
• Flag access drift as a primary signal Alert when token reuse, consent scope expansion, dormant-account reactivation or rapid permission testing changes the original trust profile.
• Bind sessions to environmental context Compare the current browser, device and location context against the context present at authentication, and escalate when the session no longer matches.
• Review long-lived token usage patterns Prioritise unusually persistent or spiking token usage because stolen possession artifacts often remain effective long after the login event has passed.
• Extend identity telemetry into ITDR workflows Feed behavioral indicators such as MFA enrollment changes, new admin account creation attempts and account recovery changes into response playbooks that are tuned for post-authentication compromise.

Key takeaways

• The core risk is not the login flow itself but the trusted session that remains active after authentication succeeds.
• The article argues that tokens, cookies and similar artifacts can let attackers bypass MFA by replaying a valid trust event.
• Identity teams need runtime monitoring, access drift detection and context comparison to govern post-login activity effectively.

Key terms

• Post-authentication behaviour: Post-authentication behaviour is what an identity does after access has been accepted. For machine and AI identities, that includes token reuse, secret retrieval, lateral movement, and policy deviation, which means defenders must watch execution patterns, not only login outcomes.
• Possession artifact: A possession artifact is a credential issued after authentication that proves the session is trusted, such as a token, cookie or assertion. In runtime governance, the artifact can become the real control object because whoever holds it may act with the original identity's access.
• Discovery drift: Discovery drift is the gap that opens when live infrastructure, asset records, and ownership data move out of sync. It creates uncertainty about what exists, who owns it, and which controls apply, which in turn weakens zero trust enforcement and lifecycle governance.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The article's full MITRE ATT&CK mapping for post-authentication techniques such as token manipulation and session hijacking
• The complete list of runtime indicators used to spot suspicious identity behaviour after login
• The article's discussion of ITDR-style monitoring for session issuance, token use and access drift
• The broader series context on how post-authentication risk fits into end-to-end IAM

👉 Unosecur's full blog expands on session hijacking, token replay and the runtime indicators behind post-login compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.