Platform Academy - June 26th, 2025 - Continuous Authentication with Zero Trust Architecture

[Sharon_Barnes]

Reinforce Your Security with Continuous Authentication and Zero Trust in ServiceNow

If you're responsible for platform security, especially in regulated environments, you've probably faced the limitations of relying solely on login-based access control. Once a user is in, traditional security models assume trust. But what happens if the session is hijacked? Or if the user's context changes?

That’s where Continuous Authentication with Zero Trust Access comes into play. In this Platform Academy livestream, Randheer Singh from ServiceNow breaks down how this new feature provides an extra layer of security—by enforcing step-up authentication within an active session.

Why It Matters

Modern security demands a defense-in-depth strategy. Even if users authenticate at login, their session context may shift. They may disconnect from VPN, switch networks, or even fall victim to session hijacking. Continuous Authentication ensures you’re not blindly trusting a session, especially when accessing sensitive records like PII or PHI.

How It Works

Administrators can set policies based on:

• Specific database tables

• Data classifications (e.g., “PII” or “Finance”)

When users access protected resources, they’re prompted to reauthenticate using either:

• ServiceNow’s built-in MFA (for local login)

• Identity Provider (IdP)-based MFA or full login (for SSO users using Okta, Azure AD, etc.)

You can even allow users to create a high-assurance session preemptively, which lasts for a configurable time window (default: 30 minutes), thereby avoiding repeated prompts.

Key Features

• Policy enforcement by table or data class

• Real-time identity checks without interrupting low-risk workflows

• Audit logging of access attempts, including location and method

• Admin flexibility: session length, retry limits, messages, and more

Licensing

This feature is available in the Yokohama release and later. A Zero Trust Access license is required, which can be obtained standalone or as part of the Vault package.

Whether you're securing government data, healthcare records, or just want finer control over privileged actions, this feature gives you serious power to enforce trust when it matters most.