The million-dollar front door and the tailgater: Why strong auth could fail at SaaS session integrity

The report argues that while modern identity controls (FIDO2, device trust, UEBA) secure logins, downstream SSO sessions remain vulnerable because applications issue portable bearer tokens/cookies that can be stolen and replayed—often via information-stealer malware—bypassing front-door protections. It calls for defense-in-depth to protect session integrity, including token binding/DPoP where supported, shortening session timeouts, IP pinning via VPN/SSE, SIEM-driven detection of session anomalies, and adopting Shared Signals for continuous access evaluation across IdPs and SaaS applications.