On-body detection is a device feature that checks whether a wearable is being worn on the body. It typically uses motion, skin contact, or proximity signals to keep the device unlocked while it remains on the wearer and to lock it when removed, reducing unauthorised access after loss or theft.
What on-body detection does
On-body detection is a wearability safeguard that keeps a device unlocked while it appears to be worn and relocks it when removed. That simple state change helps preserve convenience without leaving a lost or stolen device continuously open to anyone who picks it up.
In security terms, the feature is not a substitute for authentication. It is a local trust decision about whether the wearer remains present, so it should be understood as a convenience control with real access implications rather than as a full proof of identity.
How on-body detection works
Most implementations combine signals such as motion, skin contact, inertial patterns, or proximity to infer whether the device is still being worn. The exact method varies by platform and sensor design, and accuracy depends on how well the device can distinguish genuine wear from being carried in a pocket, placed on a table, or moved by someone else.
Because the decision is inferred from physical signals, there is always some risk of false positives or false negatives. A device may remain unlocked when it should not, or lock unexpectedly while still being worn, which is why vendors usually treat the feature as one layer within the broader device-security model.
Why it matters for device security
The main security value is reducing the window of exposure after a wearable leaves the user’s body. If a thief or finder can access an unattended device before it relocks, they may be able to read notifications, view data, or interact with paired services that remain reachable through the device.
That matters most on wearables that surface messages, health data, wallets, or other sensitive account activity. The feature is especially useful when it shortens the time between loss and lock without forcing the wearer to reauthenticate constantly during normal use.
Operational limits and user expectations
On-body detection works best when users understand what it does not guarantee. It is intended to support usable security, not to replace a PIN, passcode, biometric check, or device encryption policy, and it should be designed as a short-lived convenience state rather than a permanent trust signal.
It also depends on the quality of the device’s sensors and the context in which the device is used. Fast motion, loose wear, unusual skin contact, charging behavior, and sensor drift can all affect reliability, so security teams and product owners should treat the feature as one part of the device lock strategy, not the whole strategy.
Risk and Threat Considerations
The security concern is that an on-body signal can be mistaken for continued authorised presence, leaving a lost or stolen wearable temporarily accessible. A thief does not need to defeat the feature directly if the device stays unlocked long enough for notification viewing, app access, or account interaction.
Failure mechanism: The device infers wear state from imperfect physical signals, so stale sensor readings, loose fit, or manipulated conditions can delay relocking after removal.
Impact: Sensitive content and paired-device functions may remain accessible long enough to expose personal data, messaging, or account activity before the lock engages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | On-body detection affects how long a wearable remains unlocked after an authenticator session is established. |
| IA-2 — Identification and Authentication (Organizational Users) | The feature changes how the device treats an authenticated user after initial access is granted. | |
| AC-11 — Device Lock | On-body detection is a device-locking behavior that keeps access open only while wear is inferred. | |
| Recommendation — Set clear expiry and reauthentication rules so wearable unlock state does not persist after removal. Require a stronger login path before sensitive actions when passive wear-state trust is insufficient. Configure automatic device locking to trigger immediately when on-body confidence is lost. | ||
| ISO/IEC 27001:2022 | A.8.5 — Secure Authentication | Wear-state unlock behavior is part of protecting authenticated access to a device or session. |
| Recommendation — Document when passive unlock is acceptable and when additional authentication must be enforced. | ||
Practitioner Guidance
Why practitioners should care: Treat on-body detection as a usability control with security consequences, not as an identity boundary. Product teams should verify how quickly the device relocks after removal and how the feature behaves under edge cases such as charging, sleeping, exercise, and ambiguous motion.
Governance implication: If the device can expose sensitive notifications or app sessions, define clear policy for when on-body detection may extend unlock state and when stronger reauthentication is still required. The more sensitive the data, the less tolerance there should be for passive trust.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org