For most of the last decade, identity security has been a story about the login. Multi-factor authentication, phishing-resistant credentials, adaptive access policies - the entire industry organized itself around making the moment of authentication harder to compromise. It worked. Password-only attacks against well-configured enterprises have become genuinely difficult, and the front door is now defended in ways it never was in 2015.
So the attackers moved. They stopped trying to break the login and started stealing what the login hands out. The credential is no longer the prize. The session is. And the session is issued after every authentication control has already said yes.
The attacks that begin after authentication
What these techniques share is that none of them involve cracking a password or defeating an MFA prompt. They inherit a session that was created legitimately.
Token theft is the clearest example. An infostealer running on a compromised endpoint does not need the user’s password. It lifts the session cookies and refresh tokens already sitting in the browser and on disk, and replays them from the attacker’s own machine. Every authentication control was satisfied hours earlier by the real user. The stolen token carries that satisfaction with it.
Adversary-in-the-middle phishing achieves the same outcome at the point of login. Instead of harvesting a password, the phishing infrastructure proxies the real authentication in real time, lets the victim complete MFA, and captures the resulting session token. The one-time code was used correctly. It just was not the victim who kept the session.
OAuth consent abuse skips credentials entirely. An attacker registers a malicious application and social-engineers a user into granting it access. The user is not tricked into revealing a secret - they are tricked into authorizing one. The resulting token grants standing access to mailboxes or files for as long as the grant survives, which is often far longer than anyone monitors.
At the most severe end sits assertion forgery. An attacker who reaches an identity provider’s signing key can mint authentication assertions for any user without touching that user’s account at all. The identity provider vouches for a session that never happened. This is the class of attack the industry learned to fear after the SolarWinds intrusion, and it remains the hardest to see, because to every downstream service the forged assertion looks exactly like a real one.
Why prevention has a ceiling
The uncomfortable pattern across all four is that authentication is a one-time event and the session is a standing asset. MFA verifies who is at the door. It says nothing about who is holding the key an hour later. Passkeys, which genuinely do defeat credential phishing, do not defeat the theft of a token from a device that already authenticated. A valid token is a valid token no matter who presents it.
This is not an argument against prevention. Phishing-resistant authentication is worth every bit of the effort it takes to deploy, and the organizations that have moved to passkeys are measurably harder to breach at the login. The point is narrower and harder to sit with: prevention secures the event, and the event is no longer where the attacker is operating. In our Auth0 World Fall 2025 attendee survey, 61% of identity teams said they were confident in their ability to block a fraudulent login, and 19% said the same about detecting a stolen session being replayed after the fact. That gap is the whole problem.
Detection becomes the control that matters
Once you accept that some quantity of valid-token abuse will get past prevention, the control that decides the outcome is how quickly you notice. Post-authentication attacks are not invisible. They leave signals: a token first seen from a new country minutes after normal use, a refresh token rotating from two locations at once, a consent grant to an application no one in the organization has heard of, an assertion issued outside the identity provider’s normal pattern. MITRE catalogs these behaviors as Use Alternate Authentication Material, and the assertion-forgery variant as Golden SAML, precisely because they are recognizable once someone is watching for them.
Someone watching is the hard part. Detecting session and token abuse means correlating identity provider logs, application telemetry, and endpoint signals continuously, around the clock, with analytics tuned well enough to separate a traveling executive from a replayed cookie. Most identity teams are staffed to run the IAM platform, not to run a 24-hour detection operation on top of it. That capability gap is why a growing number of them pair their identity controls with an external managed-detection team that monitors token and session behavior and responds when the signals line up. It is a division of labor: the identity team owns the policy, and a dedicated detection function owns the watch.
What good identity detection looks like
The most useful development on the standards side is that identity providers are finally emitting the signals detection needs in near real time. The OpenID Foundation’s Shared Signals and Continuous Access Evaluation work lets an identity provider tell a relying party that a session it previously approved should now be revoked, rather than waiting for a token to expire on its own schedule. Microsoft’s Continuous Access Evaluation implements a version of this for Entra ID. The direction is the same one described in NIST’s guidance on session management: treat authorization as a continuous decision, not a one-time grant.
The practical signals worth building detection around are consistent across environments. Impossible-travel and new-device token replay catch the stolen-cookie case. Refresh-token anomaly detection catches long-lived persistence. Sudden spikes in OAuth consent grants catch application-based attacks before they scale. Monitoring the identity provider’s own signing activity, though far harder, is the only defense that sees assertion forgery at all. None of these is exotic. What they require is the sustained attention to run them, tune them, and act on them.
The frontier moved
The login is not solved, but it is understood, and the tooling to defend it is mature. The session is neither. It is where identity attacks now live, and it is defended not by a stronger gate but by continuous visibility into what happens after the gate opens. The organizations that internalize this are reorganizing their spending accordingly, shifting budget from yet another authentication factor toward the detection and response capacity that catches the attacks the factors were never able to stop. Identity has always been the control plane. The next few years will decide whether it also becomes the place where security teams watch, and not just the place where they gate.