Repeating attestation on a schedule during normal operation, so that drift, tampering or compromise is caught while the system runs.
A system that was healthy at boot can be compromised an hour later. Continuous attestation checks again and again: at every credential rotation, at a fixed interval, or before each sensitive action.
Short-lived credentials make this practical. If an identity lasts minutes or hours and renewal requires fresh evidence, a stolen credential soon becomes useless and a drifted workload soon loses access.
Open-source examples include Keylime, which checks TPM-based measurements of running Linux systems continuously, and SPIRE, which re-checks workload attributes before it issues new short-lived identities.
Example. A workload's credential lasts one hour. Each renewal needs fresh evidence, so a machine that drifts at 10:15 is out by 11:00.
Attested cloud workloadsContinuous compliance
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.