What happens after the user gets in?

A lot of application security is focused on the point of access.

• Can the user authenticate?
  

• Should this device be trusted?
  

• Is this request allowed through?

All important.

But once a session exists, the security picture changes.

A legitimate user can start behaving differently. A token can appear somewhere unexpected. A session can suddenly touch parts of the application it has never used before. Individually, those signals may mean very little. Together, they can tell a very different story.

That’s the area I’ve been thinking about while building Zubbl.

The question I’m interested in is whether we should treat the authenticated application runtime as a security boundary in its own right, rather than assuming successful authentication is the end of the decision.

Curious how others think about this. Is “security after login” a real gap in the current stack, or do you think existing identity/WAF/SIEM tooling already covers enough of it?