Re-attestation restores trust after an event. Continuous attestation keeps checking during normal operation. Most products need both.
| Re-attestation | Continuous attestation | |
|---|---|---|
| When | After state loss, expiry, update or revocation | Repeatedly, on a schedule, during normal operation |
| Goal | Recover and bootstrap trust safely | Detect drift, tampering or compromise in time |
| Example in SPIRE | Node attestors that support re-attestation (for example Kubernetes PSAT, X.509 proof of possession, TPM) | Short-lived identity rotation with workload attestation |
| Organisational twin | Renewals and re-certification | Continuous compliance |
Re-attestation and renewals handle lifecycle resets. Continuous attestation and continuous compliance handle ongoing vigilance. Both rest on the same rule: trust is never assumed for good, it is earned again.
Example. After a firmware update a device re-attests once. During the following months it is checked every hour. The first restores trust; the second watches it.
Attested cloud workloadsContinuous compliance
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.