Forgotten sessions create a standing access path on systems that many people use, especially in shift-based environments. If a user walks away without logging off, another person or attacker with physical or remote access may inherit an active session. That expands exposure, keeps resources tied up, and increases the chance of unauthorized actions under a valid account.
Why Forgotten Sessions Matter on Shared Systems
Shared workstations compress the trust boundary around a single active login. When a user leaves a session open, the workstation is no longer just a device; it becomes an opportunity for the next person at the keyboard, a curious insider, or anyone who can reach the screen through remote support or unattended access. That matters because the account is still authenticated, so the usual login checks never happen.
The risk is not limited to reading whatever was already open. Many applications preserve tokens, cached data, inboxes, administrative portals, and browser-based access to internal systems. A forgotten session can therefore become an easy path into email, HR, ticketing, finance, or cloud consoles without triggering the normal resistance that a fresh sign-in would create. In practice, the biggest loss is often not the initial screen access but the silent continuation of trust after the original user has stepped away.
On shared endpoints, the weakness tends to spread through convenience habits: users assume a short absence is harmless, while the workstation remains fully capable of acting as that identity until someone logs out or the session expires.
How Session Persistence Becomes Account Exposure
Session persistence increases exposure because authentication is usually front-loaded. Once the account has passed password, MFA, or device checks, the browser or application may keep the session alive until timeout, logout, or manual revocation. On a shared workstation, that means the next user inherits an already trusted state rather than starting from a clean verification point.
This becomes especially dangerous when the session includes elevated access or access to tools that can change data, send messages, approve requests, or reset other credentials. The person inheriting the session does not need to know the password, and in many cases does not need to bypass MFA at all. If the original user also cached tokens, synchronized browsers, or saved passwords, the workstation can expose even more than the active session itself.
Effective controls focus on reducing the life of trust on shared endpoints. Teams usually combine short idle timeouts, mandatory lock or logout behavior, reauthentication for sensitive actions, and restricted browser persistence. Shared workstations also need physical discipline, because technical timeout settings do not help if an unattended session can still be used before expiry. Guidance from NIST Cybersecurity Framework 2.0 and the control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls both point toward limiting session lifetime and protecting access continuity after initial authentication. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks is also useful here because the same lifecycle problem appears whenever long-lived trust is left in place after the original actor is gone.
For high-risk workflows, the best practice is to assume that the workstation itself can become a temporary bearer of the account’s authority and to constrain what that authority can do without a fresh challenge.
These controls tend to break down when shared terminals must support rapid handoffs, kiosk-like usage, or legacy applications that resist session timeout and reauthentication.
Where Shared Workstation Controls Usually Fail
Tighter session controls often increase friction, so organisations have to balance speed against exposure. In shift-based environments, users may skip logout because they expect the next person to continue the work, and that social pattern can defeat a policy that looks strong on paper. The control also weakens when a browser keeps multiple applications alive inside one authenticated tab set.
Another common edge case is privileged or delegated access. If the forgotten session belongs to a supervisor, administrator, or service desk operator, the blast radius is much larger because the next person may inherit approval authority or recovery actions, not just read-only access. There is no universal standard for how much reauthentication is enough in these situations; current guidance suggests using the sensitivity of the action, not only the sensitivity of the device, to decide when to force a new prompt.
Teams also underestimate remote exposure. A workstation left open in a physical space can still be abused by someone with remote desktop, support tooling, or a nearby unlocked screen, especially when monitoring is weak and the session owner is unavailable. The practical failure mode is less about a dramatic break-in and more about ordinary work habits leaving authenticated state available longer than anyone intended.
Risk and Threat Considerations
Forgotten sessions on shared workstations create a standing access path that bypasses normal authentication events. The material risk is account misuse under a valid session, which can lead to unauthorized data access, fraudulent actions, or lateral movement through systems that trust the active login.
Failure mechanism: The session survives after the original user leaves, so another person can inherit authenticated access without knowing the password or satisfying MFA again. If the workstation also stores cookies, browser tokens, or saved credentials, the same endpoint may expose additional accounts or make it easier to pivot into higher-value systems.
Impact: Sensitive records can be viewed or altered, approvals can be issued in the wrong name, and incident response becomes harder because the activity appears to come from a legitimate account rather than a forced login.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | Shared sessions create access-control exposure through unmanaged authenticated access. |
| Recommendation — Enforce reauthentication, logout, and access revocation for shared endpoints. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | Forgotten sessions weaken authentication assurance and session governance. |
| PR.PS — Platform Security | Shared workstations need endpoint safeguards against unattended trusted sessions. | |
| Recommendation — Limit session lifetime and require fresh authentication for sensitive actions. Harden shared devices with auto-lock, timeout, and restricted persistence. | ||
| NIST Zero Trust (SP 800-207) | 4 — Policy Decision and Enforcement | Access should be re-evaluated before continued use of an existing session. |
| Recommendation — Apply continuous policy checks before allowing session continuation. | ||
| NIST SP 800-63 | 5.1.2 — Reauthentication | Long-lived sessions should be reauthenticated before sensitive operations. |
| Recommendation — Trigger reauthentication for higher-risk actions and shared-device reuse. | ||
Practitioner Guidance
What to prioritise: Treat shared workstations as high-risk when they can reach email, admin consoles, finance, HR, or ticketing systems. The first control objective is not convenience; it is making sure an unattended session cannot outlive the user’s attention long enough to matter.
What to verify: Confirm that idle timeout, screen lock, browser session persistence, and application reauthentication all work together rather than separately. A single strong setting is not enough if the browser can stay signed in, the app never re-prompts, or cached credentials let the next person continue without interruption.
Decision rule: If the workstation is shared across shifts or used in a public-facing area, require logout for every handoff and force reauthentication before any action that can change data, approve requests, or reveal sensitive records. If that is operationally unrealistic, reduce what the workstation can access instead of relying on user discipline alone.
Practitioner takeaway: The real control objective is not merely session timeout; it is ensuring that no unattended device can continue to act as a trusted user longer than the organisation is prepared to accept.
Related resources from NHI Mgmt Group
- Why do fragmented authentication flows increase the risk of credential compromise in hybrid environments?
- Why do long-lived sessions increase account takeover risk?
- Why do privileged sessions increase exfiltration risk on workstations?
- Why do shared workstations and mixed devices increase identity risk in public safety environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 10, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
