A computer-implemented method may include receiving first monitored information relating to a user at a time of initial user authentication with a particular application or resource. It may be determined that a second authentication is required at a second time subsequent to the time of initial user authentication. Second monitored information may be captured at the second time. The second monitored information may be compared to the first monitored information to determine whether continued authentication is maintained. Access to the particular application or resource when it is determined that continued authentication is not maintained.