An authentication artifact is data that demonstrates a user or application has authenticated or is authorized. It may be a session cookie, access token, credential file, or other record stored on a device or held in memory. Some artifacts let services recognize a logged-in user without asking for a password again.
These artifacts matter because malware that steals a valid one may impersonate its owner and access connected services, such as code repositories or cloud accounts. The risk depends on the artifact’s scope, privileges, and expiry; additional controls can limit its use. Defenses include protecting endpoints, restricting token permissions and lifetime, monitoring for unusual access, and revoking exposed sessions or credentials promptly.