An apparatus comprising: a secure user authentication module; memory; one or more processors coupled to the memory, the one or more processors to: load the secure user authentication module into a trusted execution environment at the apparatus; a user interface; a login agent module configured to cause a prompt to be presented by the user interface at the apparatus, the prompt requesting login information to be entered into the apparatus; an operating system login authentication module configured to receive the login information from the login agent module and to transmit a signed login success message to the secure user authentication module based on the login information,wherein the secure user authentication module is further configured to transmit an encrypted authentication message to the operating system login authentication module based on receipt of the signed login success message and based on authenticating the signed login success message, and wherein the operating system login authentication module is further configured to grant access to the apparatus based on receipt and authentication of the encrypted authentication message; and a secure login policy module configured to at least determine a context for the apparatus and to set a login policy for at least one of the login agent module or the operating system login authentication module based on the context, wherein the secure user authentication module is further configured to cause the apparatus to shut down if a signed login success message is not received, and wherein the secure login policy module is further configured to set an amount of time for the secure user authentication module to wait for receipt of the signed login success message before causing the apparatus to shut down. a secure user authentication module; memory; one or more processors coupled to the memory, the one or more processors to: load the secure user authentication module into a trusted execution environment at the apparatus; a user interface; a login agent module configured to cause a prompt to be presented by the user interface at the apparatus, the prompt requesting login information to be entered into the apparatus; an operating system login authentication module configured to receive the login information from the login agent module and to transmit a signed login success message to the secure user authentication module based on the login information,wherein the secure user authentication module is further configured to transmit an encrypted authentication message to the operating system login authentication module based on receipt of the signed login success message and based on authenticating the signed login success message, and wherein the operating system login authentication module is further configured to grant access to the apparatus based on receipt and authentication of the encrypted authentication message; and a secure login policy module configured to at least determine a context for the apparatus and to set a login policy for at least one of the login agent module or the operating system login authentication module based on the context, wherein the secure user authentication module is further configured to cause the apparatus to shut down if a signed login success message is not received, and wherein the secure login policy module is further configured to set an amount of time for the secure user authentication module to wait for receipt of the signed login success message before causing the apparatus to shut down. load the secure user authentication module into a trusted execution environment at the apparatus; a user interface; a login agent module configured to cause a prompt to be presented by the user interface at the apparatus, the prompt requesting login information to be entered into the apparatus; an operating system login authentication module configured to receive the login information from the login agent module and to transmit a signed login success message to the secure user authentication module based on the login information,wherein the secure user authentication module is further configured to transmit an encrypted authentication message to the operating system login authentication module based on receipt of the signed login success message and based on authenticating the signed login success message, and wherein the operating system login authentication module is further configured to grant access to the apparatus based on receipt and authentication of the encrypted authentication message; and a secure login policy module configured to at least determine a context for the apparatus and to set a login policy for at least one of the login agent module or the operating system login authentication module based on the context, wherein the secure user authentication module is further configured to cause the apparatus to shut down if a signed login success message is not received, and wherein the secure login policy module is further configured to set an amount of time for the secure user authentication module to wait for receipt of the signed login success message before causing the apparatus to shut down.