We all agree on the goal: verify continuously—the user, the device, and the situation—throughout access. That’s the direction Zero Trust points us toward. But most IAM tools still check once and then trust for hours. That leaves a long window where things can change—and attackers take advantage of it.
They don’t always break the login. They reuse the session that comes after. Tokens and cookies are easy to carry and hard to control. So organizations respond by turning off SSO for sensitive apps and adding more MFA prompts. People get slower and more frustrated, and breaches keep happening.
If Zero Trust and real security matter, IAM has to change. A next generation model is needed.
Let’s Clarify the Obvious – or Not!
Zero Trust states the principle: continuously verify the user and the device. We suggest adding a few practical criteria—ideas that seem obvious but are often overlooked—and matter more than ever in today’s increasingly sophisticated threat landscape: verification must be accurate and resilient.
Accurate means the check is tied to the real person on the actual device in use—not just a remote assertion, which understandably can’t match the certainty of local MFA.
Resilient means the protection keeps working—and enforcing—even when networks wobble, services hiccup, or attackers try advanced tricks.
Remote prompts alone no longer meet that bar. Deepfake voice and video, social engineering, and relay kits can all fool remote checks.
The three things next‑gen IAM must do
First, anchor verification at the endpoint.
Tie access to the person on the device they’re using. Use what the device knows locally: is the right user signed in to the OS, is the screen unlocked, is the hardware key available, is the device healthy? When needed, ask for local MFA right there on the device. This is the most accurate, resilient way to confirm “user + device” over and over—without asking people to solve remote puzzles that are getting easier to fake.
Second, maintain a live trusted channel.
Trust can’t be a snapshot from the morning; it has to stay live. A trusted, always‑on connection between the endpoint and the identity service lets updates flow both ways the moment something changes. If the user locks the screen, if the device falls out of policy, if the situation changes, access adapts immediately. No long “everything is fine” window when it isn’t.
Third, bind and protect the session.
Most real‑world attacks ride the session that follows a clean login. Next‑gen IAM must close that door. However you implement it, sessions need to be bound to the verified user on the verified device so that lifted cookies and tokens don’t travel. The exact mechanics can evolve over time; the requirement does not. If someone steals a token, it should be useless off the original device.
What this feels like for people
The experience becomes simple. You sign in to your computer and start working. Nothing interrupts you when everything is normal. If you step away and your screen locks, access pauses with it. If your device drifts out of policy, sensitive actions wait until things are fixed. You aren’t solving challenges every hour; the system uses what it already knows about you and your device and only asks for more when the situation truly needs it.
What this gives security teams
Control moves closer to the facts. Decisions are based on live signals from the endpoint, not yesterday’s logs. Revocation is real time, not a helpdesk ticket. Session theft becomes much harder because sessions no longer float free from the device. And because the channel is trusted and always on, changes propagate quickly without disrupting normal work.
Optional (or not optional for you?):
These features can make a big difference in security and user experience. When evaluating IAM solutions, it’s worth considering whether they include:
- No user action experience mostly. Friction does not mean stronger security.
- Integrated password and key management at the endpoint—so it also supports legacy apps, SSH, RDP, and FIDO2 SP directly.
- Safe fallback modes for outages.
Getting there without drama
This isn’t a “big bang.” Start by treating the device login and device health as the baseline for every access decision. Establish the trusted channel so you can update and revoke in real time. Then tighten how sessions are created and maintained so they’re bound to the verified user on the verified device. As confidence grows, you can remove unnecessary prompts and extend the model to more applications.
Most IAM systems—including next‑gen ones—still need to account for unmanaged or BYOD endpoints. The safest approach is to limit those devices to lower‑sensitivity apps and apply stronger controls for anything critical.
The bottom line
Zero Trust asked us to verify the user and the device continuously. Today’s IAM tried to do that from the outside, with one‑time checks and remote prompts. That approach has reached its limit.
This is the foundation of next‑gen IAM: accurate, resilient verification at the endpoint, a live trusted channel, and sessions that can’t be stolen.
Stronger security. Fewer interruptions. Less room for attackers. That’s what next‑gen IAM should deliver.
Want to see the full framework behind this approach?
👉 Explore the 9 Principles of MagicEndpoint
Note: This discussion focuses on the access and session layer of IAM—where Zero Trust principles meet real‑world user experience. Other IAM components like PAM (Privileged Access Management) or IGA (Identity Governance and Administration) are important, but outside the scope of this post.
