Notifications
Clear all
Topic starter
23/06/2026 7:21 pm
TL;DR: Post-authentication attacks now bypass MFA by stealing session tokens, cookies, and other possession artifacts, according to Unosecur, which argues that detection must shift from login events to runtime behavior and access drift. Static authentication controls are no longer enough once the login box is crossed.
NHIMG editorial — based on content published by Unosecur: Beyond the Login, why runtime is the new battleground
By the numbers:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams detect post-authentication identity compromise?
A: They should monitor what happens after login, not just whether login succeeded.
Q: Why do strong MFA controls still leave organisations exposed to session hijacking?
A: Because MFA validates the login event, but downstream systems trust the session artifact that follows it.
Q: What do security teams get wrong about identity protection after login?
A: They often assume authentication is the main control boundary and treat post-login activity as secondary.
Practitioner guidance
- Instrument runtime session monitoring Track token reuse, session hijacking indicators, and access scope drift after authentication completes.
- Bind possession artifacts to environment context Compare the original authentication context with device state, location, browser, and historical access patterns.
- Harden high-value sessions against replay Reduce the lifetime and reuse value of long-lived tokens, and isolate privileged sessions so one stolen artifact cannot be reused across unrelated systems or administrative actions.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- MITRE ATT&CK mapping for post-authentication techniques, including valid accounts and session hijacking
- A fuller breakdown of the ten runtime indicators used to spot suspicious identity behavior
- Examples of how browser malware, AiTM, and XSS target session artifacts in practice
- The article's identity lifecycle framing from pre-authentication through authorized activity
👉 Read Unosecur's analysis of runtime identity risk after login →
Post-login identity risk: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 3:18 am
Login-centric IAM is the wrong mental model for modern compromise: authentication is only the entry condition, not the security boundary that matters most. Once a possession artifact exists, the attacker can operate inside the trusted session without returning to the login flow. The implication is that identity programmes must treat runtime behavior as the real control surface.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Another finding from the same research shows that 97% of NHIs carry excessive privileges, which makes post-authentication abuse far easier to sustain once access is granted.
A question worth separating out:
Q: Who should own controls for runtime identity risk and session abuse?
A: Ownership should sit across IAM, PAM, and detection teams because runtime identity risk crosses all three. IAM defines the trust context, PAM constrains sensitive access, and detection teams spot deviation after issuance. If those functions are isolated, the session layer becomes the blind spot where compromise is most likely to persist.
👉 Read our full editorial: Runtime identity risk is the new battleground after login
