Continuous authentication

In short

Continuous authentication is the scheme that keeps evaluating, while the session is open, whether whoever is operating is the same person who authenticated at the start. Instead of treating access as a single check at the door, it treats the session's identity as something that holds or is lost over time.

The check is passive. The person does not do anything again, unless some signal justifies interrupting them.

The problem an already-authenticated session opens up

Every authentication produces a session, and that session is what the system later accepts as proof of identity. The most demanding MFA answers a question in an instant and never asks again.

That leaves three concrete gaps.

• Session hijacking — whoever gets the session token operates as the account holder without ever having gone through authentication. The check at the door already happened.
• Device takeover — the unlocked device changes hands, within a legitimate session.
• Remote-assisted fraud — the account holder is guided over the phone to operate for someone else's benefit. The right person performs the wrong operation, and no identity check catches it.

All three share the same trait: authentication worked. What failed was assuming its result still holds an hour later.

What gets evaluated while the session stays open

The signals are contextual and behavioral, and they are read without asking the user for anything.

• Behavioral biometrics — typing rhythm, how the screen is scrolled, how the device is held. It is a statistical pattern, not an identification, which is why it works as a signal and not as proof.
• Device context — changes in the equipment, in the network, or in its security posture during the session.
• Session consistency — whether the token keeps being used from the same device and under conditions compatible with the start.
• Activity coherence — whether what is being done resembles what that person usually does.

None of these signals identify anyone on their own. Their value is in the change: what matters is not how a person types, but that halfway through the session they start typing differently.

Continuous, adaptive, and reauthentication are not the same

The three terms get mixed up in product conversations and describe different moments.

• Reauthentication — asking for the factor again every so often, or before a given operation. It is a scheduled interruption.
• [Adaptive authentication](/glosario/autenticacion-adaptativa) — evaluating risk at a specific event, typically access or a sensitive operation, and deciding whether to raise the requirement.
• Continuous authentication — evaluating permanently, in the background, and triggering one of the two above when the evidence degrades.

Put together, the relationship is clear: continuous is the one that watches, and adaptive is the one that acts when what it watches stops adding up. A long SSO session is exactly the case where that combination pays off the most, because the convenience of not authenticating again is also a long window for whoever steals the token.

Permanent monitoring adds obligations, not only capabilities

Continuously evaluating behavior means processing data about people while they use the product, and that falls under each country's data protection rules in the region. You have to be able to answer what is collected, on what legal basis, for how long it is kept, and who has access.

It is a conversation for the legal team before the product team. A continuous authentication scheme that skipped it is a regulatory debt shaped like a feature, especially in sectors where the same regulator already requires keeping evidence of the identity process.