Authentication Has a Session Trust Problem

This guest article was contributed by Alastair Parr, CTO at Spur

Organizations have made significant progress in strengthening authentication and securing workforce and customer access. Identity verification, multifactor authentication, device intelligence, behavioral analytics, fraud scoring, bot management, and conditional access policies have all made it harder for attackers to gain access using stolen credentials alone. Identity remains a valuable target, though, and attackers continue to look for weaknesses that enable fraudulent access to appear legitimate.

Cybercriminals now put a lot of effort into concealing the session. VPNs, residential proxies, and remote desktop services enable them to blend in with ordinary traffic. When valid credentials, a familiar browser profile, and a residential or mobile IP address align, a coordinated attack can look like ordinary activity from a legitimate user.

This creates a blind spot in many authentication environments. Security teams have strong visibility into the user, device, browser, and account history, while the network carrying the request receives less scrutiny. As attackers become more effective at buying or borrowing trusted-looking infrastructure, the session itself needs to become part of the authentication decision.

Where Authentication Systems Miss Session Risk

Authentication systems already look closely at almost everything involved in a login, including who the user claims to be, what device they’re on, and whether their behavior seems human. What they don’t look at is the network carrying the request. A session can pass every one of those checks and still be running through infrastructure built to hide its origin.

That blind spot shows up when familiar signals create a false sense of trust. A browser and device the system has seen before can still connect through an unfamiliar residential proxy. An account may appear low-risk when the system has no prior history of abuse associated with it. In both situations, the authentication stack may miss infrastructure context that would affect how the session is assessed.

Reputation-based defenses face another limitation because they take time to catch up. A provider or address needs to appear in enough suspicious activity before security systems classify it as risky, giving attackers a chance to exploit that lag by moving through new proxy services, rented infrastructure, and rapidly changing networks.

How Attackers Use Infrastructure to Disguise Account Abuse

Credential stuffing shows how this disguise works. Attackers used to launch these campaigns from a small pool of IP addresses, creating a recognizable pattern that organizations could detect through defenses such as rate limiting, reputation feeds, and bot controls.

Today’s campaigns can carry out those attempts across many residential connections, making each request appear to originate from somewhere different and avoiding obvious traffic spikes. From a security analyst’s perspective, the activity may appear to be ordinary, unrelated consumer traffic rather than a coordinated campaign.

Similar tactics are used in account takeover campaigns. Attackers obtain user credentials through phishing, malware, or information stealers and route the login through infrastructure near the victim using a familiar browser profile and performing normal user actions. The session may match the expected geography and appear legitimate, but the person performing the action has no legitimate relationship to the account.

Account farms follow the same playbook for account creation. Rotating the infrastructure behind each registration makes coordinated signups look like the work of unrelated users. The resulting accounts are then used to drain free trials, referral credits, coupons, and sign-up bonuses, or they are repurposed for marketplace manipulation, spam, synthetic identity fraud, and denial of inventory.

Across these use cases, anonymity infrastructure helps attackers conceal coordination, origin, and intent. The infrastructure becomes part of the identity presented to the authentication stack.

How Session Context Improves Authentication Decisions

Security teams need up-to-date context about the infrastructure that carries the request. Useful signals include whether the connection comes from a residential proxy, a commercial VPN, a data center, a remote desktop provider, an anonymization service, or an attributed network service. These characteristics help defenders determine whether the infrastructure is appropriate for the activity taking place.

Session enrichment helps shape the authentication decision. A routine login can proceed normally if the session attributes indicate it originates from a trusted network, while anonymizing infrastructure that obscures the identity behind an otherwise valid login may prompt multifactor authentication. The use of residential proxy services for mass signups may also require additional scrutiny before access is granted.

If analysts treat all infrastructure types the same, they create false positives for legitimate users and let higher-risk sessions slip through with little attention. These distinctions matter during an investigation, too. Rather than a generic risk score, attributes like residential proxy use, data center hosting or an identified VPN provider give analysts more to work with when tuning policy or investigating an incident.

That specificity also protects the people who aren’t the problem. Travelers, remote workers, privacy-conscious users, and customers on mobile networks trigger unusual location or unfamiliar network rules because of how they normally connect. A better understanding of the session helps teams determine which logins should be double-checked and which ones can proceed.

Why Every Authentication Session Needs a Fresh Risk Assessment

Session trust can change quickly as attackers rotate through new proxies, hosting providers and other infrastructure. A connection that looked legitimate yesterday offers little assurance about the one in use today, so every authentication request must be evaluated on its own.

That also puts pressure on defenses that depend heavily on historical reputation. A system may recognize infrastructure with a long record of abuse while missing a proxy provider or hosting network that attackers only recently adopted. Security teams need to know whether their controls can identify emerging infrastructure before it accumulates enough history to look risky.

Authentication decisions need to take into account the current session. Continuous assessment helps security teams respond as attacker infrastructure changes and keeps authentication decisions grounded in current signals.

Authentication teams have more signals than before, and attackers have learned how to make many of those signals appear legitimate. Security teams need to analyze the infrastructure of each individual session alongside identity, device, and behavior, and use that context to apply the right level of scrutiny. That gives defenders a clearer view of account abuse and helps legitimate users move through authentication with less friction. About the author: Alastair Parr is the CTO at Spur, where he oversees the company’s technology strategy, research agenda, and product development. He brings over 17 years of experience in governance, risk, compliance, and technical consulting. He previously served as SVP of global products and services at Prevalent and was a founder of the risk and security consultancy 3GRC.