Tamper-evident SSH session recording extends zero trust evidence

At a glance

What this is: This is a Pomerium analysis of SSH session recording for zero trust, with the key finding that recordings must be treated as evidence objects that can be tampered with outside the session itself.

Why it matters: It matters because IAM, PAM, and security teams need session evidence that stays trustworthy after capture, especially when recordings support investigations, compliance, and privileged access review.

Context

SSH session recording is the capture of terminal activity for later review, audit, and investigation. In a zero-trust model, the recording pipeline itself becomes part of the trust boundary, because once a session ends the evidence can still be modified, deleted, or forged if storage and access controls are weak.

Pomerium frames the problem as a governance issue, not just an access-control issue. If a recording cannot be independently verified, it is not reliable evidence for compliance or incident response. That places session integrity, storage accountability, and auditability alongside authentication and authorization in the control model.

Key questions

Q: What breaks when SSH session recordings are not immutable?

A: The evidence chain breaks. If a privileged actor can rewrite, replace, or delete a recording, the organisation loses confidence that the artefact reflects what actually happened. That weakens audits, investigations, and compliance reviews because the recording can no longer be treated as independent proof of the session.

Q: Why do session recordings need audit trails as well as storage controls?

A: Storage controls limit what can be changed, but audit trails show who accessed the evidence and whether access happened through the approved custody path. Without both, a recording may look intact while still being exposed to hidden modification or unauthorised replay.

Q: How should teams decide whether an SSH recording is trustworthy enough for review?

A: They should check whether the recording is immutable, whether its digest still matches after upload, and whether every access path is correlatable across the proxy and storage layer. If any of those checks fail, the recording should be treated as suspect evidence rather than verified fact.

Q: What is the difference between access control and evidence integrity for privileged sessions?

A: Access control answers who may open the session or the recording. Evidence integrity answers whether the recording still reflects the original event after storage, replay, or download. In zero trust, both matter because a legitimate viewer can still be handed a tampered artefact.

Technical breakdown

Why SSH recordings need their own trust model

SSH session recordings are often treated as passive logs, but in practice they are evidentiary artifacts with their own lifecycle. Once captured, they move into storage systems, object permissions, and replay workflows that sit outside the SSH session itself. That shift matters because a privileged actor with storage access can target the recording rather than the server. Zero trust therefore has to extend beyond who can open the session and into who can alter, replay, or remove the evidence later. The trust question becomes whether the recording remains authentic after custody changes.

Practical implication: treat session recordings as governed evidence, not disposable logs.

How immutability and digest checks make tampering detectable

Pomerium describes two linked integrity mechanisms. First, recordings are written as immutable objects, so the platform does not rewrite them in place. Second, the SSH reverse proxy generates a digest for session data and verifies it against the stored recording after upload. If the digest changes, the recording is rejected. This does not stop every storage-layer abuse, but it makes modification visible and therefore contestable. Object versioning and storage audit logs then help reveal whether changes occurred outside the platform’s custody.

Practical implication: pair immutable storage controls with independent integrity verification for every recording.

Why audit trails matter for custody and replay

Tamper evidence is stronger when every access path leaves a trace that can be correlated across systems. Pomerium Enterprise emits audit events for metadata retrieval, replay, and download, and those events carry a unique access identifier and a hash of the user’s identity. It also embeds that same information in cloud-provider audit logs so access outside Pomerium’s custody can be detected. This is a custody model as much as a logging model: if the markers are missing, the access path is suspect.

Practical implication: ensure recording access can be correlated across the access proxy and the storage layer.

Threat narrative

Attacker objective: The objective is to compromise the integrity of session evidence so the organisation can no longer trust what the recording shows.

1. Entry occurs when a privileged actor reaches the recording store or replay path after the SSH session has ended.
2. Escalation happens if that actor can delete, alter, or replace the stored session artifact instead of only viewing it.
3. Impact is the loss of trustworthy evidence, which can undermine investigations, compliance validation, and privileged access accountability.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Recording evidence has become an identity governance object, not a storage artifact. Once SSH session data is used for audit, compliance, or investigation, its trustworthiness matters as much as the access decision that produced it. That shifts the control question from simple retention to verifiable custody and tamper detection. For practitioners, the recording pipeline deserves the same governance attention as the privileged session itself.

Immutability is necessary but not sufficient for privileged session evidence. The article shows why object locking, versioning, and retention controls help, but only when paired with an independent integrity proof. A recording that cannot be rewritten in place can still be questioned if upload or storage corruption goes undetected. The decisive issue is whether the evidence remains provably the same after custody changes.

Session evidence needs dual accountability across the access proxy and the storage layer. Pomerium’s use of access identifiers and identity hashes reflects a broader control principle: evidence must be traceable in both the system that created it and the system that stores it. That reduces the chance that privileged access disappears into a single administrative domain. Practitioners should treat cross-system audit correlation as a core control, not a nice-to-have.

Tamper-evident session recording extends zero trust into the evidence plane. Zero trust is often implemented only at authentication and authorization, but this article shows that the evidence produced by those decisions also needs continuous verification. That expands the programme boundary in a useful way: if the recording is unreliable, the access control story is incomplete. Teams should govern evidence with the same skepticism they apply to access requests.

From our research library:

• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Tamper-evident session evidence: zero trust programmes are starting to move beyond session admission and into evidence custody, because audit artefacts can be attacked after the session ends. That means privileged access governance now has to include integrity checks, not just access decisions.

Enterprises that rely on SSH for administrative access should treat recording verification as part of the control plane, not as a back-office logging concern. If recordings are used for investigations or compliance, the organisation needs a repeatable way to prove that the artefact in storage is the artefact that was captured.

The evidence model also reinforces a broader PAM lesson: a privileged session is only half the story if the record of that session can be manipulated later. Teams that centralise access without governing evidence custody create a new blind spot in their zero-trust programme.

For practitioners

• Define recordings as governed evidence Classify SSH recordings as protected audit evidence with explicit ownership, retention, and access rules rather than generic operational logs.
• Require immutable storage for session artefacts Use object locking, retention policies, or equivalent controls so recordings cannot be rewritten in place after capture.
• Verify digests after upload Check that the session digest generated at capture still matches the stored object before accepting the recording as trustworthy.
• Correlate access across systems Make sure storage audit logs and access-proxy logs share a unique access identifier and identity hash so out-of-custody access stands out.

Key takeaways

• SSH session recordings can become a governance liability if their custody and integrity are not controlled as tightly as the live session itself.
• The article’s model relies on immutable storage, digest verification, and correlated audit trails to keep recordings independently verifiable.
• Practitioners should extend zero trust beyond authentication and authorization to the evidence created by privileged access.

Key terms

• Tamper-evident recording: A tamper-evident recording is a session artefact designed to reveal any alteration after capture. In identity governance, that means the recording can be trusted as evidence only if integrity checks, immutability controls, and audit trails can prove it has not been changed.
• Evidence Custody: Evidence custody is the controlled ownership of audit artefacts from collection through retention and review. It matters because a compliant record is only useful if the organisation can prove it was not altered, selectively removed, or shaped by the teams under review.
• Digest verification: Digest verification compares a cryptographic fingerprint generated at capture with the fingerprint of the stored artefact later on. If the two values do not match, the recording has changed or the upload path has been corrupted, which makes the evidence unreliable for audit or investigation.
• Immutable object storage: Immutable object storage is a storage pattern where data cannot be modified in place after it is written. For session recordings, immutability reduces the chance of silent rewrite, but it still needs integrity checks and audit logs to prove the object remained trustworthy across custody changes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.