Continuous Access Evaluation in Practice: CAEP, RISC, and Shared Signals

01Quick Reference

Static authentication tokens represent a fundamental flaw in modern enterprise security, granting persistent access that often outlives the validity of a user’s security posture. Shared Signals, specifically through the Continuous Access Evaluation Profile (CAEP) and Risk Incident Shared Intelligence Confirmation (RISC) frameworks, provide a standardized mechanism for Identity Providers (IdPs) and Service Providers (SPs) to communicate security events in near real-time.

Implementing these standards reduces the window of vulnerability from hours to milliseconds, fundamentally changing the return on investment for identity-based attacks. By moving from a periodic to a continuous validation model, organizations can enforce security policies at the moment of risk detection rather than waiting for token expiration.

02The Obsolescence of Static Session Management

The industry standard for session management has long relied on the "check-at-the-door" model. Once a user authenticates via OpenID Connect (OIDC) or SAML, they receive a session token typically valid for 8 to 24 hours. During this interval, the Identity Provider (IdP) is effectively blind to the user's activities and security status, assuming the initial authentication remains valid.

If a device is stolen or a session cookie is hijacked ten minutes into an eight-hour shift, the attacker maintains access for the remaining seven hours and fifty minutes. Traditional IAM infrastructures are structurally incapable of responding to these events mid-session because they lack a back-channel for real-time communication.

According to the Verizon Data Breach Investigations Report (DBIR) 2024, 68% of breaches involved a non-error human element, frequently manifesting as stolen credentials or session hijacking. This statistic highlights the critical failure of time-based session validity in an era of automated attacks.

The latency between a security event, such as a password reset or a detected malware infection, and the termination of downstream application sessions is a primary vector for lateral movement. Shared Signals Framework (SSF) addresses this by moving away from pull-based polling toward a push-based event notification system.

This framework allows the IdP to "push" a notification to every connected application the moment a risk is detected. This is no longer a luxury for advanced enterprises; it is a prerequisite for any organization claiming to follow Zero Trust principles as defined by NIST SP 800-207.

03Technical Architecture of Shared Signals

The Shared Signals Framework, developed under the OpenID Foundation, consists of two primary profiles: CAEP and RISC. While both use the same underlying transmission mechanism—Security Event Tokens (SETs), defined in RFC 8417—they serve distinct operational purposes within the identity lifecycle.

SETs are JSON Web Tokens (JWTs) designed specifically for communicating security events rather than user identity or authorization. They contain an event payload that describes what happened, when it happened, and which subject (user or session) was affected.

RISC: Account-Level Security

RISC (Risk Incident Shared Intelligence Confirmation) focuses on the lifecycle of the account itself. It is designed to communicate major shifts in the security state of a user identity that transcend individual sessions.

If a user's account is recovered after a compromise or if the IdP detects a credential spill on the dark web, RISC signals this to all participating service providers. This allows the providers to take preventive measures, such as forcing a password change or clearing local caches.

Key RISC events include:

• account-purged
• credential-compromise
• recovery-activated
• account-disabled

CAEP: Session-Level Security

CAEP (Continuous Access Evaluation Profile) is more granular and operational, dealing with the active session and the context of the user’s current access. It is the primary mechanism for real-time enforcement in a Zero Trust environment.

If a user’s IP address suddenly shifts to a known malicious exit node, or if a management agent reports that a device has fallen out of compliance, CAEP triggers an immediate re-evaluation. This ensures that access is only maintained as long as the security context remains within acceptable thresholds.

Key CAEP events include:

• session-revoked
• token-claims-change
• credential-change
• assurance-level-change

04Vendor Landscape and Implementation Status

The market for CAEP and RISC is currently bifurcated between early-adopting "Transmitters" (IdPs) and a group of "Receivers" (SaaS applications) that are slowly catching up. For decision-makers, the value of an IAM stack is now directly proportional to its ability to participate in this event-driven ecosystem.

Microsoft Entra ID

Microsoft was a primary driver of the original CAEP specification and continues to lead in first-party integration. Their implementation, branded as Continuous Access Evaluation (CAE), is deeply integrated into the Microsoft 365 ecosystem and Azure resources.

Microsoft Entra ID Strengths

• Native, zero-configuration support for Exchange Online, SharePoint Online, and Microsoft Teams.
• Integration with Microsoft Defender for Endpoint to trigger session revocation based on real-time device health signals.
• Robust support for "Critical Event Evaluation," which covers password resets, account deletions, and location changes.

Microsoft Entra ID Limitations

• Third-party application support is currently more complex to configure than first-party application support.
• Full functionality requires Entra ID P1 or P2 licensing, which increases the total cost of ownership (TCO) for smaller organizations.

Okta

Okta has positioned itself as a neutral hub for Shared Signals through its "Identity Threat Protection" (ITP) feature, which is powered by Okta AI. They focus on orchestrating signals from a wide variety of security vendors.

Okta Strengths

• Strong focus on the "Shared Signals Pipeline," allowing for the ingestion of signals from third-party security vendors like Zscaler, CrowdStrike, and Netskope.
• Highly customizable "Workflows" that can automate complex remediation steps beyond simple session termination, such as notifying security teams via Slack.
• The broadest support for non-Microsoft SaaS applications through the Okta Integration Network.

Okta Limitations

• Identity Threat Protection is typically an add-on SKU, which some enterprises find adds significant cost to their existing subscription.
• Requires significant configuration of "Post-auth Session Evaluation" policies to achieve maximum effectiveness across diverse application sets.

Ping Identity

Ping Identity offers extensive support for the Shared Signals Framework through PingOne DaVinci, their primary orchestration engine. They focus on the flexibility required by complex, global enterprises.

Ping Identity Strengths

• Superior for hybrid-cloud environments where legacy on-premises applications must be bridged to modern CAEP signals.
• High degree of flexibility in how signals are processed, filtered, and transformed before being sent to downstream receivers.
• Strong support for custom event types that may not yet be fully standardized in the OpenID Foundation profiles.

Ping Identity Limitations

• High implementation complexity; requires skilled IAM architects to design and maintain the orchestration flows.
• A smaller ecosystem of pre-built "Receivers" compared to the Microsoft or Okta marketplaces.

05Business Impact and ROI Considerations

Investing in CAEP and RISC is a strategic move to reduce the "Blast Radius" of a compromised identity. It shifts the defensive posture from reactive cleanup to proactive containment.

06Reduction in MTTR (Mean Time to Remediate)

In a traditional environment, remediation is a manual process where an administrator must identify the compromise and then manually kill sessions in AWS, Salesforce, and Slack. With CAEP, this happens in seconds. Reducing the Mean Time to Remediate from 4 hours to 4 seconds directly correlates to reduced data exfiltration risks.

07Cyber Insurance Premiums

Insurance providers are increasingly scrutinizing "active session management" as a key risk indicator. Demonstrating the use of CAEP can be a significant lever during premium negotiations, as it addresses the "Session Hijacking" risk category. According to the Marsh Cyber Claims Report 2025, session-based attacks have become a leading cause of loss in the technology sector.

08Operational Efficiency

Automating session revocation reduces the burden on the Security Operations Center (SOC) by handling the immediate containment of threats. Instead of chasing "low-fidelity" alerts, the IAM system handles the initial response, allowing analysts to focus on deep root cause analysis and long-term remediation.

09The Interoperability Challenge

While the industry marketing suggests a seamless "plug-and-play" world of shared signals, the reality is far more fractured. The "Transmitter" side of the equation is relatively mature, but the "Receiver" side—the SaaS applications—is still evolving.

As of late 2025, only a handful of major SaaS vendors have robust, documented support for receiving and acting upon SSF signals from third-party IdPs. Many Tier 2 and Tier 3 vendors still rely on proprietary APIs or have no mechanism for external session termination.

Enterprises must be wary of "Security Theater" where signals are sent but never processed. Implementing CAEP on your IdP provides zero protection for an application that does not have a listener configured for the signal.

This creates a dangerous "visibility gap" where security teams believe they have revoked access, but the attacker remains active in a critical, non-compliant application. Practitioners must verify the end-to-end flow for every critical application in their portfolio.

10Feature Comparison: Leading IAM Providers

11Strategic Recommendations

For organizations looking to move beyond static identity, a phased roadmap is essential to avoid operational disruption.

1. Audit Your "Receiver" Ecosystem Before upgrading your IdP license, demand a "CAEP Support Statement" from your top 10 most critical SaaS vendors. If they do not support SSF, pressure them to add it to their 2027 roadmap or provide a proprietary API for session management.

2. Prioritize High-Risk Users Do not attempt to roll out CAEP to the entire enterprise at once. Start with "Privileged Users," such as system administrators, executives, and developers who have access to sensitive production environments and intellectual property.

3. Implement a "Signal Buffer" Use an orchestration layer to filter signals and prevent "alert fatigue" or accidental lockouts. You do not want every minor "impossible travel" alert to kill a high-priority session during a critical business event.

12Failure Modes and Mitigation

Implementing Shared Signals introduces new failure modes that practitioners must account for during the design phase. A primary risk is the "Signal Loop," where a revocation event triggers a re-authentication that immediately triggers another revocation.

Another common failure mode is "Token Expiration Mismatch," where the IdP revokes a session but the SP's local cache persists for several minutes. This is often caused by clock skew or misconfigured TTL (Time to Live) settings on the receiver side.

To mitigate these risks, implement strict monitoring on the Shared Signals bus. Log every SET sent and received, and create alerts for high volumes of revocation events, which may indicate a misconfigured policy or a widespread system error.

13Key Takeaways

Shared Signals, CAEP, and RISC represent the most significant advancement in identity security since the introduction of Multi-Factor Authentication (MFA). While the ecosystem is still maturing, the move toward event-driven, continuous security is inevitable for any modern enterprise.

Enterprises should view CAEP not as a standalone feature, but as the "connective tissue" of a Zero Trust architecture. Without it, your security posture remains a series of disconnected islands, and your response time will always be a step behind the adversary.

14Actionable Next Steps

• Immediate (30 Days): Enable Microsoft CAE if you are an Entra ID customer, as it is a low-effort improvement for M365 applications.
• Short-Term (90 Days): Conduct a formal gap analysis of your SaaS portfolio's support for the Shared Signals Framework and update your vendor requirements.
• Long-Term (6-12 Months): Integrate your EDR (e.g., CrowdStrike, SentinelOne) and SSE (e.g., Zscaler, Netskope) signals into your IdP’s shared signals pipeline to create a unified, automated risk-response engine.