A user signs in with a passkey. The authentication is phishing-resistant. The identity provider records a successful challenge. Every dashboard says the login worked as designed.
Hours later, an attacker reuses a stolen session token.
No password is entered. No push notification appears. No new authentication ceremony occurs. The application sees a valid artifact and accepts it.
Both facts can be true at the same time: the authentication was strong, and the session was compromised.
That is the identity problem security programs need to address next.
Passkeys, hardware security keys, conditional access, and stronger account recovery are essential. They protect the process of establishing identity. But modern applications rarely ask a person or workload to prove identity again for every action. They rely on tokens and assertions that carry the result of an earlier decision across applications, APIs, clouds, and sessions.
The security boundary therefore does not end at login. It moves with the token.
NIST and CISA made that point operational in the final September 2026 release of NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. The report addresses the keys that create trust, the systems that validate it, the lifetime of tokens, session monitoring, revocation, workload identity, and the division of responsibility between cloud providers and their customers.
The practical lesson is straightforward:
Treat every token as a live authorization decision, not as a receipt proving that authentication once succeeded.
