Two questions decide whether a session is safe. Is this a real human, or an agent? And is it the right human? A login can answer both at one moment, and the session goes on for hours.
Key takeaways
- The first question is whether the thing in the session is a real human or an agent. The second is whether it is the right human.
- A login answers both only at one moment. Everything after is inferred from a token.
- Mimoto answers both questions continuously, passively, with nothing for the real user to do.
Question one: is this a real human?
AI changed this question. In a campaign Anthropic disclosed in November 2025, an AI agent carried out an estimated 80 to 90 percent of the work against roughly thirty organizations, with human operators stepping in only at a few decision points. Agents can now run attacks, and they increasingly pass for people.
Mimoto asks it in two places. At your website sign-up forms, Mimoto Continuous CAPTCHA makes a clear call on every sign-up: person or agent. Inside your systems, Mimoto Continuous Verification answers it all session long, as part of confirming the right human.
Question two: is it the right human?
Even a real human can be the wrong one. A stolen password, a hijacked session, a shared login, a contractor using someone else’s access, or a person sitting down at an unlocked laptop all produce a valid session driven by someone else.
Mimoto Continuous Verification builds a picture of the specific person from how they type and move, how they use their apps, their device and connection, and the context of the session. It uses advanced pattern matching and anomaly detection. It never captures what they type.
What happens when the answer changes
The response is a dial, not a switch. Depending on the risk, Mimoto can re-verify the person, restrict the session, or end it. It enforces natively, or it signals into the SIEM and other SOC tools a team already uses, with notifications to Slack, Microsoft Teams, Google Chat, PagerDuty, email, or any channel the team prefers. The real user does not feel any of it.
Questions answered
What are the two questions Mimoto asks?
Is this a real human, or an agent? And is it the right human? Mimoto Continuous Verification answers both through the whole session. Mimoto Continuous CAPTCHA answers the first at website sign-up forms.
Why isn’t a login enough?
A login is a single point in time. Sessions last hours, and tokens can be stolen or sessions taken over after the login succeeds.
Does Mimoto capture what people type?
No. Mimoto measures how a person interacts, never what they type.
Does the real user have to do anything?
No. Verification is passive, with no prompts or added steps.
Sources
- Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, November 13, 2025.
- Mimoto, Closing the Identity Gap (white paper).
