This means that organizations need a way to recognize when a session that once earned their trust no longer deserves it. 

MFA Is a Checkpoint, Not a Guarantee of Trust

Authentication establishes a level of confidence in a user at a particular moment, but that risk can change later in the session. 

There may be little reason to intervene again for a user who logs in from a familiar device and is performing normal activity. If, however, they begin performing actions that they typically don’t, particularly ones involving sensitive information or account settings, security teams may have reason to investigate further. 

Several unusual actions during the same session could strengthen that concern.

This is where authentication can become more dynamic. Instead of making a trust decision at login and allowing it to persist for the rest of the session, companies should continuously evaluate risk and request additional verification when the context warrants it.

Attackers Can Manipulate the Context Around Authentication

Making those decisions requires understanding more than identity and device information. 

Attackers increasingly have access to infrastructure that helps malicious activity resemble legitimate traffic. Residential proxies are particularly useful because they route connections through consumer internet connections. This allows attackers to appear to connect from the same kinds of residential or mobile networks as legitimate users. 

Commercial VPNs and other anonymizing services provide additional ways to obscure a connection’s true origin. 

These services complicate the signals organizations have traditionally used to assess risk. An IP address may originate in the expected country or city, for example, while providing little indication of where the person controlling the session is actually located. An IP address may also have a clean reputation simply because attackers only recently began using it.

Using a VPN or residential proxy doesn’t automatically make a session malicious either, since legitimate users commonly use those services for various reasons. 

Organizations, therefore, need enough context to understand whether the infrastructure and behavior make sense for a particular user. 

Trust Should Change as the Session Changes

This makes passive signals particularly valuable because they can provide additional context without repeatedly interrupting users.

Location history, network characteristics, device information, behavioral patterns, and indicators of anonymizing infrastructure can all contribute to an organization’s level of confidence in a session. 

Historical context can help determine whether those signals are consistent with how the user typically connects and behaves. 

If an employee who normally connects from the same device and corporate network suddenly connects through an unfamiliar residential proxy, that might not be enough information to block their access. If the session then begins requesting information outside the employee’s normal responsibilities, those additional signals could indicate that someone else has gained control of the account.

This kind of contextual evaluation helps security teams distinguish between an unusual but legitimate connection and activity that warrants intervention.

Better Authentication Doesn’t Have to Mean More Authentication

Continuous evaluation shouldn’t translate into asking users to prove their identity every few minutes. Better context can help organizations be more selective about when they introduce friction. 

The response should reflect both their confidence in the session and the potential consequences of the activity. This approach allows organizations to strengthen security around higher-risk activity while keeping routine interactions as seamless as possible.

MFA will remain essential as attackers continue to target identities and accounts. But as attackers become more effective at disguising compromised sessions, organizations need to be just as effective at recognizing when the context surrounding an authenticated user has changed. The ability to reevaluate trust after login will be increasingly important to keeping those accounts secure.