Why do FIDO2 deployments still leave organisations exposed after login?

Why This Matters for Security Teams

fido2 reduces password theft and phishing at the login boundary, but it does not eliminate the post-authentication attack surface. Once the browser or application holds an active session, adversaries can pivot to cookie theft, token replay, OAuth consent abuse, or browser-based man-in-the-middle techniques. NIST’s NIST SP 800-63 Digital Identity Guidelines reinforce that authentication is only one part of digital identity assurance, not a complete session-security model.

That gap is visible in real incidents. NHIMG’s 52 NHI Breaches Analysis shows how compromised identities often remain exploitable long after the initial access event, and the same lesson applies to human sessions once trust is established. Security teams often overestimate what “phishing resistant” means and underinvest in session controls, device posture checks, and token lifecycle management.

In practice, many security teams discover that the hard part begins after login, when attackers no longer need to beat FIDO2 and only need to hijack what the application has already trusted.

How It Works in Practice

Effective post-login defense treats the session as a living security object. The goal is to continuously evaluate whether the current request still deserves access, rather than assuming the original authentication event is enough. Current guidance suggests combining FIDO2 with device trust signals, short-lived tokens, reauthentication for sensitive actions, and conditional access that can step up or terminate a session when risk changes.

For high-risk workflows, organisations should tie session issuance to the context of the request: device health, location, network reputation, browser integrity, and application sensitivity. This is where identity assurance extends beyond the passkey itself. If the session token can be replayed from a different endpoint, the attacker inherits the user’s privileges unless the platform can detect session drift. The Anthropic report on the first AI-orchestrated cyber espionage campaign is a reminder that adversaries increasingly automate credential abuse and follow-on access with speed that outpaces manual review.

• Bind sessions to device signals, not just user authentication.
• Use short-lived access tokens and rotate refresh tokens aggressively.
• Require reauthentication or step-up approval for privileged actions.
• Detect impossible travel, token replay, and browser session anomalies.
• Revoke sessions automatically when posture or risk changes.

For identity and access teams, this also means aligning app controls with broader NHI governance. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now highlights how modern identity programs fail when credentials outlive their intended use. These controls tend to break down in legacy web apps and SSO integrations that treat browser sessions as static trust rather than continuously evaluated access.

Common Variations and Edge Cases

Tighter session controls often increase friction, requiring organisations to balance security against user experience and operational support. That tradeoff is real, especially in environments with frequent switching between devices, long-running workflows, or regulated transaction approvals. Best practice is evolving, and there is no universal standard for when every session must be revalidated.

The strongest exception cases usually involve low-risk internal applications or tightly managed kiosk-style endpoints, where aggressive step-up prompts may create more burden than value. Even then, long-lived cookies, broad OAuth grants, and permissive refresh-token policies still create exposure. For SaaS estates, consent abuse is a common blind spot because the user may authenticate correctly while a malicious application gains durable access through granted scopes. For environments with unmanaged BYOD, browser hardening and token binding become more important, but implementation quality varies widely.

In short, FIDO2 remains an important control, but it is not a full post-login defense strategy. Organisations that do not pair it with continuous session validation, short token lifetimes, and strong device assurance will still be exposed after authentication, especially in modern browser-heavy SaaS and federated identity environments.

Related resources from NHI Mgmt Group

• When does a phishing-resistant login method still leave organisations exposed?
• Why do partial passwordless deployments still leave organisations exposed?
• Why do MFA deployments still leave organisations exposed to identity risk?
• Why do identity platforms with good login controls still leave organisations exposed?