Even companies that have successfully adopted single sign-on and multi-factor authentication technologies are scrambling to understand and secure what employees do after they log in.