Continuous evaluation is the practice of re-checking trust signals after a user logs in, instead of treating authentication as a one-time event. Those signals can include device posture, location changes, session age, unusual behavior, and current risk scores. If the signals weaken, the system can step up verification, limit privileges, or end the session.
It matters because many attacks succeed after the initial login. Stolen cookies, hijacked sessions, abused recovery flows, and compromised devices can all bypass a strong password or even phishing-resistant sign-in if the session is never reviewed again. In defense, continuous evaluation supports Zero Trust by letting access decisions change as context changes. In real deployments, it is often paired with conditional access, endpoint trust checks, and anomaly detection, helping organizations react before a session becomes a full breach.