A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors of an authentication system in a network, causes performance of operations comprising: authenticating a client device to obtain access to network resources in a network via a network authentication protocol, wherein authenticating the client device via the network authentication protocol comprises: receiving a device certificate from the client device, wherein the device certificate has been issued to the client device upon a previous successful user authentication based on receiving valid user credentials from the client device; and authenticating the client device, to transition the client device to an authenticated state, based on validity of the device certificate; Periodically requiring the client device which is placed in the authenticated state to perform automatic re-authentication with the device certificate by asking the client device to present a valid device certificate to the network in order to remain in the authenticated state, whereby this automatic re-authentication happens in a background process without the device user's knowledge; while the client device is in the authenticated state, detecting a device quarantine trigger indicating an increased level of suspicion that a current user of the client device is a non-authenticated user; and in response to the device quarantine trigger, temporarily placing the client device from the authenticated state to a quarantined state pending completion of a particular workflow by the current user, wherein the client device has limited access to the network resources while in the quarantined state regardless of a previous successful user and/or device authentication. authenticating a client device to obtain access to network resources in a network via a network authentication protocol, wherein authenticating the client device via the network authentication protocol comprises: receiving a device certificate from the client device, wherein the device certificate has been issued to the client device upon a previous successful user authentication based on receiving valid user credentials from the client device; and authenticating the client device, to transition the client device to an authenticated state, based on receiving a device certificate from the client device, wherein the device certificate has been issued to the client device upon a previous successful user authentication based on receiving valid user credentials from the client device; and authenticating the client device, to transition the client device to an authenticated state, based on validity of the device certificate; Periodically requiring the client device which is placed in the authenticated state to perform automatic re-authentication with the device certificate by asking the client device to present a valid device certificate to the network in order to remain in the authenticated state, whereby this automatic re-authentication happens in a background process without the device user's knowledge; while the client device is in the authenticated state, detecting a device quarantine trigger indicating an increased level of suspicion that a current user of the client device is a non-authenticated user; and in response to the device quarantine trigger, temporarily placing the client device from the authenticated state to a quarantined state pending completion of a particular workflow by the current user, wherein the client device has limited access to the network resources while in the quarantined state regardless of a previous successful user and/or device authentication.