What Happened
The authentication model that's protected enterprise systems for two decades has hit a breaking point. Organizations have treated identity verification as a one-time event: check credentials at login, grant access, and move on. Meanwhile, generative AI and deepfake technology have enabled attackers to convincingly impersonate legitimate users throughout entire sessions. This isn't a breach in the traditional sense; it's an architectural failure. Static identity checks can't defend against threats that evolve continuously within an active session.
Timeline of the Control Gap
2020-2022: The credential compromise era
Phishing-resistant authentication gained traction. FIDO2 passkeys eliminated password theft as an attack vector. Organizations felt they had overcome credential-based attacks.
2023: Deepfake technology commoditizes
Voice synthesis and video manipulation tools became accessible to mid-tier threat actors. While the authentication moment remained secure, post-authentication sessions were left unmonitored.
2024: The realization
Security teams discovered that passing the front door no longer guaranteed the person behind the keyboard remained the same throughout the session. Static checks at login couldn't detect in-session takeovers or AI agents operating with stolen session tokens.
Which Controls Failed or Were Missing
Missing: Continuous authentication
Organizations implemented strong perimeter authentication but treated the session as trusted once established. They lacked mechanisms to re-verify identity based on behavioral signals, device posture changes, or anomalous actions during active sessions.
Failed: Single-point verification
The control model assumed authentication happened once. A user proved their identity, received access, and that trust persisted until logout. This worked when credential theft was the primary threat. It fails when attackers can assume identity mid-session or when AI agents operate autonomously.
Missing: Trust fabric integration
Authentication systems operated in isolation from other security controls. They didn't consume signals from endpoint detection, network monitoring, or application behavior analytics. A session that passed authentication at 9 AM received the same trust level at 3 PM, regardless of what happened in between.
Failed: Wallet and credential lifecycle visibility
As digital wallets emerged as credential containers, organizations lacked visibility into how credentials were issued, managed, and presented. There was no common baseline for evaluating wallet security posture or credential freshness.
What the Relevant Standards Require
FIDO2 addresses authentication, not continuous trust
FIDO2 solves phishing-resistant authentication at login by proving possession of a cryptographic key pair. It doesn't address what happens after authentication succeeds. The standard focuses on the authentication ceremony, not session management.
OAuth 2.0 separates authentication from authorization
OAuth 2.0 enables Delegated Authorization but treats the authorization decision as point-in-time. Once an access token is issued, it remains valid until expiration. The standard doesn't require continuous re-evaluation of trust during the token lifetime.
Zero Trust principles demand continuous verification
The Never Trust, Always Verify principle requires ongoing assessment. NIST's Zero Trust Architecture (SP 800-207) explicitly states that trust must be continually evaluated. Yet most implementations verify at the perimeter and assume trust thereafter.
The gap: No standard defines continuous identity verification
We have standards for strong authentication, standards for authorization, and principles for Zero Trust. We lack a standard that defines how to continuously verify identity throughout a session. FIDO Alliance's wallet certification program represents an attempt to establish a common baseline for credential management, but it's focused on issuance and presentation, not continuous trust evaluation.
Lessons and Action Items for Your Team
1. Instrument your sessions for trust signals
Don't treat authentication as binary (passed/failed). Collect behavioral signals throughout the session: typing patterns, mouse movements, request patterns, geographic consistency. You're not trying to re-authenticate constantly. You're building a trust score that degrades when signals diverge from baseline.
Start with three signals you can measure today: request volume deviation, geographic impossibility (two requests from different continents within minutes), and privilege escalation attempts. Log them. Establish baselines. Define thresholds that trigger step-up authentication.
2. Implement session risk scoring
Build a Policy Decision Point that consumes authentication strength, device posture, network context, and behavioral signals. Assign each session a trust score that updates in real-time. When the score drops below a threshold, require step-up authentication before allowing sensitive actions.
Your Policy Administrator should enforce different policies based on trust score. High-trust sessions get frictionless access. Medium-trust sessions face additional challenges for sensitive operations. Low-trust sessions terminate or force re-authentication.
3. Adopt wallet-based credentials with visibility
If you're evaluating digital wallets for credential management, demand visibility into the wallet's security posture. Can you verify the wallet's attestation? Do you know when credentials were issued? Can you detect if the wallet has been compromised?
FIDO Alliance's wallet certification program aims to provide this baseline. Until it's available, establish your own requirements: cryptographic attestation of wallet integrity, audit logs of credential presentation, and the ability to revoke credentials at the wallet level, not just the application level.
4. Don't wait for perfect standards
Andrew Shikiar's observation applies here: "If you build it, they will come, it's a fallacy. You need to build it and make sure they come." Standards bodies are working on continuous trust frameworks, but your threat landscape isn't waiting. Implement continuous authentication with the tools you have. Use adaptive authentication policies. Consume threat intelligence feeds. Integrate session monitoring with your Security Information and Event Management (SIEM) system.
5. Test against AI-powered attacks
Run tabletop exercises where the attacker has access to deepfake voice synthesis and can impersonate legitimate users. Can your controls detect the attack? Does your step-up authentication rely on factors that AI can't replicate? Multi-Factor Cryptographic Devices remain effective because they require physical possession. Behavioral biometrics provide resistance because AI can't perfectly replicate human interaction patterns.
The shift from static checks to continuous trust isn't a future problem. It's an architectural requirement the moment AI-powered attacks became accessible. Your authentication controls already failed this test. The question is whether you'll recognize the failure before an incident forces the recognition.
