What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The least disruptive secure configuration is risk-based session monitoring, not constant password or MFA prompts. Set separate overall and inactivity timeouts, use only signals tied to a defined security purpose, and map each risk condition to proportionate step-up authentication, session termination, or support review. Start with the system’s required authentication assurance level, then tailor the policy to the application, endpoint, device management, and operating environment.
National Institute of Standards and Technology (NIST) guidance treats continuous authentication as monitoring an already authenticated session for signs of fraud, with periodic reauthentication to confirm that the subscriber is still present. Its timing recommendations are baselines, not a universal setting for every private system or jurisdiction.
What continuous authentication should—and should not—do
Continuous authentication is an ongoing evaluation of session characteristics after login. A session secret preserves continuity while the service looks for changes that could indicate account takeover, session theft, an unattended workstation, or an anomalous device. NIST calls this activity session monitoring and notes that it is sometimes called continuous authentication. Periodic reauthentication verifies continued presence; it does not require the user to re-enter credentials after every click.
NIST explicitly favors session management over continual credential presentation because repeated prompts can encourage workarounds such as caching activation factors, undermining the intended security and obscuring when a genuine authentication event occurred. The practical objective is therefore to keep ordinary work uninterrupted while escalating only when exposure or risk justifies it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
“The periodic reauthentication of sessions SHALL be performed to confirm the subscriber’s continued presence at an authenticated session (e.g., that the subscriber has not walked away without logging out).”
A secure design has four parts: an assurance target, two independent timers, governed monitoring signals, and a response policy. Omitting any one of them either leaves sessions exposed or creates needless friction.
Choose timing from the assurance level
First classify the service’s target Authentication Assurance Level (AAL) under the applicable digital identity framework. NIST’s SP 800-63B-4 recommendations provide an upper boundary for reauthentication and, at higher levels, inactivity. The values below are recommended limits from the 2025 publication; they are not measured attack-reduction or usability statistics.
| Assurance level | Overall timeout (maximum recommended) | Inactivity timeout | How to use the baseline |
|---|---|---|---|
| AAL1 | 30 days between authentication or reauthentication events | Optional | Suitable only where the consequences of account compromise are comparatively limited. Add an inactivity limit when unattended access is plausible. |
| AAL2 | 24 hours | 1 hour maximum recommended | Use for services needing stronger protection. After inactivity but before the overall limit, a verifier may allow reauthentication with a successful password or biometric comparison plus the still-valid session secret. |
| AAL3 | 12 hours | 15 minutes maximum recommended | Use the shorter idle boundary and follow all AAL3 reauthentication requirements for high-consequence services. |
These limits come from NIST SP 800-63B-4, Authentication Assurance Levels. NIST also says the applicable timeout depends on the endpoint, whether it is managed, the environment (such as a restricted area), and the application. A private system can impose a shorter period when its threat model requires it, but should document why.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep the two timers independent
The overall timeout limits how long a session may remain authenticated since the last authentication or reauthentication, even when the user is continuously active. The inactivity timeout ends the session after no subscriber activity for the configured period. Activity resets only the inactivity clock; it must not extend the overall limit. A successful reauthentication resets both.
Before expiry, the service may display a warning and let the user make the session active or reauthenticate. This preserves an enforced deadline while avoiding an unexpected loss of work. Do not let a warning silently extend a session without the required authentication event.
Define signals by the threat they are meant to detect
Monitoring characteristics are choices, not a mandatory checklist. Select the smallest set that provides a defensible security benefit and state what action follows when a characteristic changes. Possible inputs identified by NIST include:
- Usage patterns, velocity, and timing: detect an implausible sequence, sudden high-volume activity, or a session moving at a speed inconsistent with the normal workflow.
- Behavioral biometrics: typing cadence or similar interaction patterns can provide supporting evidence that the same person is present. Treat these as probabilistic signals, not as an infallible identity proof.
- Device and browser characteristics: a new browser profile, altered device properties, or a change from a managed to an unmanaged endpoint can increase risk.
- Geolocation: an abrupt location change may indicate a stolen session, but location can be imprecise and may expose sensitive information.
- IP characteristics: changes in network, hosting-provider address space, or other reputation indicators can be useful context without being conclusive on their own.
There is no NIST-defined universal score, feature weighting, false-positive rate, or prompt threshold. Your organization must validate its chosen signals against its users, document the rationale, and revisit it when the application or threat model changes. More telemetry is not automatically safer.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Map risk evidence to a proportionate response
A changed signal should be treated as evidence, not an automatic instruction to interrupt the user. Define response tiers in advance so that operators and the service behave consistently.
| Condition | Typical response | User experience objective |
|---|---|---|
| Low-risk deviation, such as a normal network change on a managed device | Continue the session and record the event for monitoring | No prompt during routine work |
| Moderate risk, such as a new browser characteristic or unusual velocity | Step-up reauthentication using an approved authenticator; apply additional checks to sensitive actions | Ask once when evidence justifies it, then restore normal flow after success |
| High confidence of session theft or impossible activity | Terminate the session, revoke its secret, and require a fresh login | Explain the security action and provide a recovery path |
| Ambiguous or repeated anomalies | Notify designated support or security personnel while enforcing the relevant timeout | Give the user a clear status and a way to resolve a false positive |
When monitoring identifies potential fraud, NIST says the relying party should coordinate with the credential service provider, identity provider, or verifier. Available actions include reauthentication, session termination, or notification of appropriate support personnel. A policy that sends an MFA prompt for every deviation is not risk-based and will train users to approve prompts reflexively.
Tailor settings to the endpoint and work environment
The same account may need different controls on different endpoints, provided the distinction is explicit and defensible.
Managed corporate workstation
A device enrolled in endpoint management, protected by screen lock, and used on a controlled network may support the baseline timeout with monitoring focused on session and device changes. An unattended-session risk still exists; do not use device management as a reason to remove inactivity protection where the application handles sensitive data.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Shared, public, or kiosk device
Use a short inactivity limit and avoid persistent browser sessions. Clear session data at sign-out, prevent “remember me” behavior where appropriate, and make termination visible. A shared endpoint is a design rationale for stricter settings, not a reason to collect every possible behavioral signal.
Mobile or intermittently connected workflow
Network and location can change during ordinary movement. Weight those characteristics cautiously and provide a low-friction step-up method that works when connectivity is restored. Do not treat a temporary IP change as proof of compromise.
High-consequence action
Even with a valid session, require step-up authentication immediately before actions such as changing recovery factors, exporting sensitive records, or authorizing a material transaction. This limits the damage from a session that was hijacked after the initial login.
Keep relying-party and identity-provider sessions distinct
In a federated arrangement, the relying party (RP) session and the identity provider (IdP) session are separate. An IdP may help evaluate an authenticator event or coordinate a response, but the RP remains responsible for its own session secret, overall timeout, inactivity timeout, and application-level authorization. Signing out of one session does not automatically prove that every other session has ended.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Document which component owns each timer, how a step-up request is conveyed, and how revocation reaches active sessions. If an IdP terminates its session, the RP should define whether it immediately invalidates its local session or waits for a verified status signal.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make privacy governance part of configuration
NIST warns that most monitoring characteristics have privacy implications. Include the collection, storage of expected characteristics, and processing of those characteristics in a privacy-risk assessment, as described in the session-management guidance.
- State the security purpose for every signal and remove signals that do not support a defined decision.
- Specify what baseline or “expected” pattern is stored, how it is updated, and how long raw and derived data are retained.
- Restrict access to monitoring data and record administrative access.
- Explain the monitoring in user-facing notices, especially when behavioral or location data is involved.
- Provide a review path for people whose legitimate work repeatedly triggers a step-up or termination.
Privacy minimization also improves reliability: collecting fewer, better-understood signals makes it easier to investigate why a decision occurred and to correct a bad baseline.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsImplementation procedure
- Classify the service. Record the target AAL, data sensitivity, high-consequence actions, user population, endpoint types, and whether devices are managed.
- Set the overall timeout. Choose a value no longer than the applicable AAL recommendation. Record the event that starts the clock: initial authentication or successful reauthentication.
- Set the inactivity timeout. Configure a separate idle limit appropriate to the endpoint and environment. At AAL1 it is optional; at AAL2 and AAL3 use the published maximum recommendations as an upper boundary.
- Define pre-expiry behavior. Decide when to warn, what the warning says, and which reauthentication methods are available. Ensure the warning cannot bypass the deadline.
- Choose signals and owners. For each signal, document its purpose, data source, expected-value storage, retention, privacy impact, and the team responsible for tuning it.
- Create response tiers. Specify the evidence for continue, step-up, terminate, and support-review outcomes. Include revocation and notification behavior.
- Test ordinary and adverse journeys. Verify that activity resets only inactivity, successful reauthentication resets both timers, a terminated session cannot call protected APIs, and a federated sign-out behaves as documented.
- Measure and review. Track prompt frequency, termination reasons, support overrides, and confirmed incidents for your own environment. These are operational measurements, not universal benchmarks; use them to adjust thresholds and signal selection.
Common configuration mistakes and fixes
- One timer for everything: separate overall exposure from unattended-session exposure.
- Activity extends the overall session: allow activity to reset only inactivity; require reauthentication at the overall deadline.
- Every anomaly triggers MFA: create a risk tier and reserve prompts for evidence that warrants them.
- Location or IP treated as proof: combine contextual signals and account for normal travel, mobile networks, and privacy limitations.
- Monitoring without a privacy assessment: document collection, expected-pattern storage, access, and retention before enabling the feature.
- Ignoring the application’s sensitive actions: require step-up authentication at the action boundary, not only at login.
- No recovery for false positives: give support personnel a documented review path and tell users how to regain access without weakening controls.
- Assuming the IdP controls the RP session: define local RP timers and revocation explicitly in the federation design.
Use phishing-resistant reauthentication where the risk requires it
At AAL2, NIST requires verifiers to offer at least one phishing-resistant authentication option; AAL3 requires phishing resistance and a non-exportable private key. A FIDO2 passkey with user verification is listed among NIST’s implementation examples, but compatibility and assurance depend on the particular service and endpoint. A hardware security key can be an authenticator for step-up or reauthentication; it does not perform session monitoring or choose timeout values. See NIST’s Authenticator Examples for the implementation context.
What a defensible policy looks like
A concise policy might state: “This service operates at AAL2. Sessions require reauthentication within 24 hours and end after one hour of inactivity. Managed-device and browser changes are evaluated as risk signals; ordinary network changes are logged but do not prompt by themselves. A high-risk action requires phishing-resistant step-up authentication. Suspected session theft revokes the session and alerts support. Monitoring data is limited to documented signals, retained for the approved period, and reviewed under the privacy-risk assessment.” The exact wording and thresholds must reflect your own application and evidence; NIST does not prescribe a universal score.
The resulting balance is straightforward: enforce the assurance-level timers, monitor only for a stated purpose, escalate in proportion to evidence, and make reauthentication easy when it is genuinely needed. That combination protects long-lived sessions without turning normal work into a sequence of credential interruptions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
