Modern security has become very good at establishing identity. Credentials can be checked, MFA completed and access policies evaluated before a user reaches an application. But that is only the beginning of the session.
Authentication is a moment in time
A successful login tells the application that an identity satisfied the checks required to gain access.
The same user may then remain signed in for hours and make hundreds or thousands of requests. Authentication does not continuously explain whether all of those actions still make sense.
The identity can stay valid while everything around it changes
Consider a user who normally accesses a predictable set of routes, from familiar network infrastructure, at a fairly stable rate.
Now the same authenticated session begins appearing from different infrastructure, moving through unusual parts of the application and attempting a large export of sensitive data.
The original authentication has not necessarily failed. The interesting change is what is happening around that identity.
The application has context that matters
The application knows more than the existence of an HTTP request. It can know the user, tenant, route, action, entitlement, workflow and business operation involved.
It can also observe the sequence of activity that led to the current request.
That application context makes a different kind of security decision possible after access has already been granted.
Not every anomaly is an attack
A VPN connection is not automatically malicious. A country change is not automatically account compromise. A burst of requests is not automatically abuse.
The useful question is what those facts mean together, in the context of the identity, session, route and behaviour being observed.
Trust after login
This is the problem I have become increasingly interested in while building Zubbl.
Authentication answers whether access should begin. Runtime trust asks a different question: should this interaction still be trusted now?
That gap between successful authentication and what happens afterwards is where Zubbl operates.