Topic starter
19/08/2026 3:44 pm
TL;DR: Attackers are increasingly bypassing MFA by stealing session cookies, then operating inside authenticated sessions where most identity programs lose visibility, according to Expel's analysis of a video interview with Jason Rebholz. The real gap is not login security alone but post-authentication detection, least-privilege drift, and the growing governance burden of non-human identities and AI agents.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Why identity security is a verb, not a noun”.
Key questions
Q: What breaks when security teams only monitor the login event?
A: They miss the point where the attack actually succeeds.
A: Stolen credentials are valuable because they can grant direct access without a fresh login, especially when active session cookies bypass multi factor authentication.
Q: What are the signs that least privilege controls are failing?
A: Common signs include dormant accounts that still authenticate, users retaining access after role changes, contractors keeping old credentials, and service accounts with broader access than the task requires.
Practitioner guidance
- Instrument session-level detection Correlate identity events with application activity so investigators can see what happened after authentication, not just whether the login succeeded.
- Map SaaS blind spots Inventory applications that sit outside SSO or have incomplete logging, then classify them as identity visibility gaps rather than isolated app issues.
- Tighten entitlement scope Review where broad or manually approved access still exists, especially in business apps where stolen sessions can exercise normal user rights.
Bottom line: Attackers are increasingly winning after authentication, not before it, because session cookies and valid sessions let them bypass the login checkpoint.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:22 pm
Post-authentication identity risk is now the real control boundary: the industry over-invested in login assurance and under-invested in what happens after authentication succeeds. That is not a visibility inconvenience, it is a structural failure of the identity model. Once an attacker can operate inside a trusted session, the relevant control plane shifts from the login event to the session itself, and practitioners must recognise that as the primary security boundary.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: Post-authentication identity risk is where attackers win today