Constantly verifying user identities is the way forward - but many are unrealistic about their efforts.