Notifications
Clear all
Topic starter
10/07/2026 9:28 pm
TL;DR: Digital identity programmes that stop at login, MFA, or session validation leave a gap between access and trust, according to Uniken’s summary of EIC 2026. Continuous trust shifts assurance to every meaningful interaction, which makes runtime context, device signals, and transaction-level proof more important than static checkpoints.
NHIMG editorial — based on content published by Uniken: Continuous trust, why access management alone is no longer enough
Questions worth separating out
Q: How should security teams move from access management to continuous trust?
A: Start by separating authentication from assurance.
Q: Why do traditional IAM controls fall short for continuous trust?
A: Traditional IAM controls are usually point-in-time checks.
Q: What do organisations get wrong about identity proofing and recovery?
A: They often treat proofing and recovery as administrative steps rather than attack surfaces.
Practitioner guidance
- Map trust hand-offs across the full customer journey Trace onboarding, login, routine use, high-risk actions, recovery, and cryptographic change as separate assurance moments.
- Replace shared secrets with proof-based interactions Reduce dependence on passwords, bearer tokens, and knowledge-based recovery where stronger device-bound or signed proofs are viable.
- Introduce runtime checks for high-risk transactions Apply step-up authorisation, transaction signing, and contextual risk signals when the action matters more than the login.
What's in the full article
Uniken's full article covers the operational detail this post intentionally leaves for the source:
- The specific continuous trust flow described for onboarding, authentication, and recovery across the customer lifecycle.
- The platform logic behind device-bound authentication, signed transactions, and shared risk signals.
- The practical role of wallet credentials and EUDI orchestration in privacy-preserving verification.
- The article’s discussion of how runtime protection changes fraud posture without relying on long-lived bearer tokens.
👉 Read Uniken's analysis of continuous digital trust and access management limits →
Continuous digital trust: what it means for IAM teams?
Explore further
10/07/2026 9:50 pm
Access management alone is a checkpoint, not a trust model. The article is right to separate entry from assurance, because authentication proves presence, not continuity. Identity programmes that stop at session creation assume the interaction remains trustworthy after the first decision, which is no longer a safe assumption in customer identity, mobile flows, or agent-mediated journeys. Practitioners should stop treating login success as evidence of ongoing legitimacy.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who should own continuous trust across people, devices, services, and AI agents?
A: Ownership should sit with identity and security leaders together, because continuous trust spans IAM, fraud prevention, device posture, and runtime policy. The programme should not be split by channel or actor type, since the same trust failure can start with a user, a device, a service, or an agent.
👉 Read our full editorial: Continuous digital trust is replacing access-only identity models
