Why Identity Needs Continuous Monitoring After Login

Identity checks such as presenting an ID, taking a selfie or completing a liveness test can establish who is signing in. But passing that check does not prove the same person remains in control of the session afterward, argues Udi Abram, identified in the source as AU10TIX’s VP of Corporate Affairs.

Abram describes reliance on a one-time login check as the “tollbooth mentality.” He says attackers can take over after a legitimate login with session-hijacking malware or remote-access tools. Fraud operations may also have real people complete onboarding before handing an authenticated session to someone else or to automated systems. In these cases, the initial identity check may have worked as intended.

He argues that services should assess identity throughout a session using signals such as typing cadence, navigation patterns, device behavior and network telemetry. A sudden change—for example, typing activity that appears automated or a handheld device becoming unnaturally static—could raise a session’s risk score, prompt additional verification or, in high-confidence cases, end the session.

Fintechs, crypto exchanges and neobanks have strong incentives to adopt continuous, risk-based monitoring because fraud can quickly cause financial losses, Abram writes. He also argues that adding more login hurdles can burden legitimate customers without slowing automated attackers. The article says organizations should use proportionate interventions that limit disruption for low-risk customers while responding to anomalous behavior. These views are Abram’s; the source says they are not necessarily those of TechRadar Pro or Future plc.