Security teams detect Person in the Middle (PITM) by looking for signs that traffic is being relayed through an attacker who is actively participating in the session. Common indicators include certificate warnings, unexpected authentication prompts, session token abuse, unusual proxy paths, and endpoint or network telemetry that shows interception. Strong mutual authentication reduces detection reliance.
What PITM looks like in telemetry and user experience
Person in the Middle is often detectable because the victim is not talking directly to the expected party, even if the login flow appears normal. Watch for certificate anomalies, repeat or unusual authentication prompts, token replay patterns, and network paths that do not match the user’s normal egress or proxy chain. These signals matter most when they cluster during sign-in or session handoff.
Mutual authentication and phishing-resistant methods change the detection picture because they reduce the attacker’s ability to quietly insert themselves into the exchange. When those protections are missing, security teams have to rely more heavily on correlating endpoint, identity, and network events to spot interception.
Why interception paths are the key detection surface
PITM is a session-relay problem, so the best indicators usually come from inconsistencies between where the session claims to originate and where it actually transits. A legitimate session should have a stable relationship between user, device, browser state, and the identity provider. When that relationship breaks, such as by an unexpected reverse proxy, new relay host, or token used from a different path than the one that established it, the chance of interception rises.
AiTM Phishing Guide is useful here because the same relay patterns that enable adversary-in-the-middle phishing are the ones defenders can hunt in proxy logs, token theft indicators, and detection workflows. The practical question is not whether a proxy exists, but whether the proxy is preserving an expected trust path.
Security teams should also pay attention to sequence. A PITM session may show normal authentication followed by immediate token reuse, a second login from a different network location, or a session that behaves differently after MFA succeeds. Those gaps are often more reliable than a single alert.
How to confirm suspicion without overcalling normal proxy use
Not every proxy, gateway, or identity relay is malicious, so confirmation depends on correlation. Start with the authentication event, then validate the device, IP, user agent, TLS posture, and token handling around that same time window. If the same account suddenly produces parallel session activity, unexpected consent screens, or a token that appears valid in one place and suspicious in another, treat it as a possible interception chain rather than an isolated anomaly.
Teams should also compare what the endpoint saw with what the identity layer saw. Endpoint telemetry can reveal browser tampering, unusual extensions, or local certificate changes, while network telemetry can show transparent relay behavior or destination mismatch. The more those views disagree, the more likely an active middleman is present.
Strong authentication controls can help, but they do not eliminate the need for monitoring. Phishing-resistant methods reduce token capture opportunities, yet teams still need evidence of session integrity, especially for privileged users and high-value workflows.
Risk and Threat Considerations
PITM is dangerous because the attacker does not need to break the login itself, only to sit inside it long enough to steal or relay the resulting trust. That makes the compromise subtle, and it often survives basic MFA if the attacker can capture a live session or replay a token quickly enough.
Failure mechanism: The attacker inserts a relay between the user and the service, captures the authenticated session material, and then reuses or proxies it before normal detection logic notices the path change.
Impact: The session may look legitimate while the attacker reads data, performs actions as the user, or escalates into adjacent systems through trusted access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | PITM is a relay/interception technique that maps directly to adversary-in-the-middle behavior. |
| Recommendation — Map relay indicators to T1557 and hunt for interception paths in identity and network telemetry. | ||
| NIST SP 800-63 | Phishing-Resistant Authenticators | Phishing-resistant authentication reduces the session capture conditions that PITM relies on. |
| Recommendation — Prefer phishing-resistant authenticators to reduce relay-based session theft. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Detecting PITM depends on continuous correlation of identity, endpoint, and network telemetry. |
| Recommendation — Correlate sign-in, endpoint, and network data continuously to spot interception anomalies. | ||
Practitioner Guidance
What to verify: Confirm whether the suspicious session has a path, device, and token history that match the user’s normal sign-in pattern. The most useful evidence is a joined view of identity logs, network telemetry, and endpoint signals, not any single alert in isolation.
Decision rule: If the same account shows successful authentication followed by unusual relay indicators, treat it as possible session theft or interception even when the password and MFA event were valid. Validate the session, then decide whether containment requires token revocation, sign-out, or credential reset.
What good looks like: Mature detection does not depend on users noticing warnings first. It continuously checks whether authenticated sessions still have a credible trust path, especially for privileged accounts, remote access, and browser-based SSO flows.
Practitioner takeaway: PITM detection is mostly about proving that the session still belongs to the path that created it, because once an attacker is inside the trust boundary, the strongest signal is often inconsistency rather than an obvious alarm.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org