--- title: "The Fifteen Minutes That Assumed You'd Walk Away" canonical: "https://current.tinyfish.ai/issue/37/echoes/article/29867/the-fifteen-minutes-that-assumed-youd-walk-away" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" author: "Rina Takahashi" author_url: "https://current.tinyfish.ai/team/25" issue: 37 section: "echoes" section_name: "Echoes" published: 2026-07-08 updated: 2026-07-09 word_count: 273 source_links: 1 --- # The Fifteen Minutes That Assumed You'd Walk Away *By [Rina Takahashi]()* *July 8, 2026* [Read on the website]() The 15-to-30-minute idle timeout is one of the most familiar conventions in application security. Its logic is straightforward: if a session goes quiet, the human probably left. Kill the session before someone else sits down. OWASP's testing guide spells out the scenario plainly. A public computer, a user who forgot to log out, an attacker who presses the back button. The entire control is a proxy for physical presence. If the session is quiet, nobody's at the keyboard. OWASP's own [session management cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) documents the gap, though: if something keeps generating requests, the timer resets and the timeout never fires. They wrote that about session hijackers. It also describes every web agent ever deployed. An agent conducting a multi-step workflow produces activity continuously. It has no idle state. So the timeout was never really measuring intent or authorization. It was measuring whether someone was still physically sitting at a desk, which is the one thing a machine will never stop doing. **OWASP idle timeout ranges:** 2–5 minutes for high-value applications, 15–30 minutes for low-risk ones **PCI DSS v4.0 Requirement 8.2.8:** Sessions handling cardholder data must time out after 15 minutes of inactivity, requiring re-authentication **PCI's stated rationale:** Prevent unauthorized access "if an agent leaves their workstation unattended." The word "agent" here means a call-center employee **The known limitation:** OWASP notes that a hijacked session can be kept alive indefinitely by generating periodic activity, which is also the exact behavior of any working software agent **Absolute timeouts exist** as a complementary control (OWASP suggests 4–8 hours for office workers), but these were calibrated to human shift patterns, not machines that don't have shifts ## More - [Echoes — Issue 37]() - [Issue 37]() - [Publication guide]()