Insights
Glossary
Plain definitions of the terms that come up in every conversation about verifying the person, not the credential.
Account takeover
When an attacker gains control of a legitimate account and uses it as if they were the owner.
Agentic attack
There are several different types of agentic attacks, ranging from persistent brute force attacks at scale and agentic speed to sophisticated attacks utilizing frontier models.
Behavioral signals
How a person interacts: how they type and move, how they use their apps, their device and connection, and the context of the session.
Continuous CAPTCHA
Mimoto’s check on website registration and sign-up forms. It makes a clear call on every sign-up, person or agent, and diverts agentic AI pretending to be people.
Continuous identity assurance
Continuous verification of an identity or person.
Continuous verification
Verification that runs for the whole session, from authentication to logout, instead of once at the door.
Credential misuse
Using a real username and password, or a real token, that belongs to someone else.
Edge deployment
Deployment on edge devices.
ICAM
Identity, credential, and access management. Systems that issue and check credentials, such as the Common Access Card (CAC) and the Personal Identity Verification (PIV) card.
Inauthentic worker
A bad actor using a stolen credential, an internal bad actor using someone else’s access, a nation-state-sponsored employee, or agentic AI pretending to be a person.
Insider threat
Risk from someone with legitimate access, or from an outsider who has gained it. Once inside with valid credentials, both look the same to most tools.
Non-human identity
An account or credential used by software rather than a person, such as a service account, an API key, or the credentials an AI agent uses.
Pattern matching and anomaly detection
Two ways of spotting risk. Pattern matching looks for known patterns. Anomaly detection spots when activity departs from what is normal.
Person-based verification
Checking that a specific human is present, rather than checking a credential, a device, or an account.
Proportional response
Responding only as far as the risk warrants: monitor, re-verify, restrict, or end the session.
Re-verify
A step-up check that asks the person to confirm it is them, used only when the risk calls for it.
Session
The span between authentication/token creation and logout.
Session hijacking
Taking over a session after authentication/token creation.
SIEM
Security information and event management. A system where security teams collect and investigate security events. Mimoto is integrated with leading SIEM providers.
Zero Trust
A security model built on never trusting by default and always verifying.
See where the gap sits in your environment
Want to see Mimoto catch the wrong person in a live session? We will set up a time.