When customer-facing pages rely on third-party tags, CDNs or browser-loaded content that can change independently of the release pipeline. In that situation, dependency scanning remains necessary, but runtime governance becomes the control that protects the live attack surface.
Why runtime script governance belongs in the browser, not just the pipeline
Runtime script governance becomes the priority when the live page can execute code that your build pipeline did not fully control, such as third-party tags, CDN-hosted libraries, A/B testing scripts, analytics beacons, chat widgets or payment embeds. Dependency scanning still matters, but it only sees what was present at build or package time. Governance at runtime is what constrains the current, user-facing attack surface.
That distinction matters because browser-delivered content can be changed after release, by a vendor, a tag manager, or an attacker who compromises an upstream service. For customer-facing pages, the security decision is not whether dependencies exist, but whether the organisation can observe, approve and restrict what executes in the browser at the moment it is loaded.
What runtime governance protects that scanning cannot
Dependency scanning is strongest for known packages, pinned versions and software supply chain review. Runtime script governance is stronger when the risk comes from dynamic execution, late-bound code delivery, or content assembled outside the application release process. If a script can change independently of your deployment pipeline, the control you need is not only package visibility, but runtime control over source, integrity and execution behaviour.
This is especially important for scripts that can read page content, modify forms, inject UI elements, or call back to external endpoints. Those behaviours are often invisible to dependency scanners because they emerge only when the page runs. Good governance therefore treats script provenance, loading policy and allowed destinations as first-class controls, not as optional extras layered on after software inventory.
For browser-delivered content, the live page is effectively part of production infrastructure. That makes runtime controls a better fit than a build-time lens when the business impact comes from what the user actually receives, not merely what the repository contains.
How to decide which control should lead
Use runtime script governance first when the organisation depends on any code path that can be modified outside release control, especially on revenue, login, checkout, support or high-traffic customer journeys. Use dependency scanning first when the primary question is whether a shipped application or library version contains known vulnerabilities, outdated components or malicious packages. In many environments, both are needed, but they solve different failure modes.
The practical test is whether a compromise or change can appear after your last deploy. If yes, the strongest control must be the one that limits what the browser is allowed to fetch and execute now, not the one that only analysed yesterday’s artifact. If no, and the content is fully packaged and versioned with the application, dependency scanning may carry more of the detection burden.
Current guidance in web and supply chain security increasingly favours layered assurance for externally sourced content, with runtime policy acting as the final guardrail when the organisation does not fully own the code path.
Risk and Threat Considerations
Runtime script exposure creates a larger live attack surface because a trusted page can be altered without changing the application binary or package manifest. The main risk is that an attacker, compromised vendor, or injected third-party snippet can reach users through an apparently legitimate page and manipulate data, sessions, or transactions.
Failure mechanism: A script source, tag manager, CDN asset, or embedded widget changes after deployment, and the browser loads code whose behaviour was never covered by dependency scanning or release approval.
Impact: Organisations can lose control over page integrity, expose customer data, enable credential theft or payment tampering, and create a gap between what security teams reviewed and what users actually executed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V12 — Secure Communication | Runtime script governance depends on controlling what the browser loads and trusts. |
| Recommendation — Restrict loaded resources and require integrity controls for externally delivered browser content. | ||
| NIST CSF 2.0 | PR.DS-10 — Data in Transit is Protected | Live script delivery is a trust and protection problem for browser-transmitted content. |
| Recommendation — Protect browser-delivered content with transport and integrity safeguards. | ||
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Runtime script governance is an integrity control for code that can change after release. |
| Recommendation — Validate and monitor externally sourced code before allowing execution. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The question concerns securing browser-executed application content beyond dependency scans. |
| Recommendation — Apply application security controls that cover code integrity and runtime behaviour. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Script governance often uses integrity mechanisms such as signing and verification. |
| Recommendation — Use integrity protections where browser content must be trusted after delivery. | ||
Practitioner Guidance
What to prioritise: Put runtime governance ahead of dependency scanning when the business-critical page depends on third-party delivery or late-bound browser code. Use dependency scanning to reduce package risk, but do not treat it as a substitute for controlling the live execution surface.
What to verify: Confirm which scripts are first-party, which are third-party, which can change without a deploy, and which have access to sensitive page elements. If any of those scripts influence authentication, checkout, or personal data handling, runtime policy and monitoring should be mandatory.
Practitioner takeaway: The more independently the browser content can change, the less sufficient build-time scanning becomes, and the more the organisation should rely on runtime governance to control actual user exposure.
Related resources from NHI Mgmt Group
- When should organisations prioritise runtime privacy controls over governance documentation?
- When should organisations prioritise runtime protection over pre-runtime scanning for cloud workloads?
- When should organisations prioritise runtime governance over recertification?
- When should organisations prioritise runtime attribution over posture scanning for AI agents?