AI-native browser threat hunting changes secure enterprise detection

At a glance

What this is: Push Security is arguing that browser threat hunting should pivot from IOC chasing to AI-assisted detection of attacker techniques and tactics.

Why it matters: For IAM and NHI practitioners, that matters because browser activity is now a primary control point for identity attacks, phishing, and session abuse that static indicators miss.

By the numbers:

• more than half of organizations (55%) reporting a successful or suspected browser-based attack in the last 12 months
• 88% indicating it is among their top five security priorities

Context

Browser security is no longer just a matter of blocking known-bad destinations. As attacks move through the browser, identity signals, session behaviour, and user interaction patterns become part of the detection problem, especially when adversaries can mutate infrastructure and delivery methods quickly.

The governance gap is that IOC-led controls assume the threat will remain recognisable long enough to be matched, while browser-based campaigns increasingly change shape before that happens. For identity teams, the question is no longer whether the browser is monitored, but whether the control model can recognise technique-level abuse across sessions and users.

Key questions

Q: How should security teams detect browser-based attacks when indicators change constantly?

A: They should focus on attacker behaviour, not just infrastructure indicators. Browser attacks often rotate domains, URLs, and IPs faster than defenders can block them, so useful detections key on repeatable techniques such as consent phishing, credential capture flows, and user interaction patterns that reveal intent even when the campaign changes shape.

Q: Why do browser-based attacks matter to IAM and identity governance teams?

A: Browser-based attacks matter because the browser is where users authenticate, work, and move data in the same session. If IAM stops at login, it misses the post-authentication behaviour where phishing, fraud, and data leakage occur. Identity governance now has to include session policy and content control.

Q: What are the signs that IOC-based detection is failing in the browser?

A: A common sign is repeated exposure to the same technique even after domains or URLs are blocked. If alerts keep arriving for different infrastructure but the same user interaction pattern, the control is too dependent on static indicators and not enough on the underlying tactic or workflow.

Q: How do browser detections and identity response work together after a suspected phishing event?

A: Browser detections should feed identity investigation, session review, and access revocation together. The browser can reveal how the attack entered, but IAM and incident response determine whether the token, session, or delegated access is still active and whether the compromise can continue beyond the initial alert.

How it works in practice

Why IOC-based detection misses browser attacks

Indicators of compromise are useful when an attack is stable, but browser-based campaigns increasingly rotate domains, URLs, IPs, and delivery infrastructure as fast as defenders can block them. Technique-driven detection instead looks for the behaviour behind the campaign, such as consent phishing patterns, device code abuse, or click-through workflows that reveal attacker intent even when the infrastructure changes. That is why browser telemetry matters: it gives context on navigation, user interaction, and identity-related events inside the session. Practical implication: detection engineering needs to prioritise behaviours and sequences that persist across campaigns, not just known artefacts.

Practical implication: tune browser detections to attacker behaviour, not only known bad indicators.

How agentic threat hunting changes browser telemetry analysis

An agentic system can ingest threat research, test hypotheses against telemetry, and generate candidate detections much faster than a manual queue. The operational point is not that the model is magical, but that the workflow becomes continuous: evidence collection, hypothesis generation, validation, and deployment happen in one loop. That matters in the browser because the signal surface is high volume and noisy, and the value comes from rapidly separating meaningful identity and session patterns from background activity. Practical implication: teams should think about detection pipelines as learning systems, not static rule sets.

Practical implication: treat detection as a continuous analysis pipeline rather than a fixed rule library.

Why browser-based identity attacks now sit inside the control plane

The browser has become a control plane for identity because it mediates authentication, session use, consent, and access to cloud applications. That means browser compromise or abuse does not just create a phishing event, it can expose delegated identity flows, token use, and user-approved access paths. In that sense, browser security is now adjacent to IAM, PAM, and NHI governance even when the attack starts with a user click. Practical implication: security teams need browser telemetry integrated with identity monitoring, not treated as a separate endpoint problem.

Practical implication: connect browser detections to identity governance and session monitoring workflows.

NHI Mgmt Group analysis

Browser detection is becoming an identity control, not just an endpoint control. Once authentication, consent, and session activity all happen in the browser, technique-level detection becomes part of identity governance. That shifts the centre of gravity from blocking destinations to understanding how identities behave inside the session. Practitioners should treat browser telemetry as identity evidence, not just security noise.

IOC chasing fails because attackers now treat indicators as disposable. Domains and URLs are cheap to replace, and AI lowers the cost of rotating infrastructure even further. What does not change as quickly is the attack technique, which is why TTP-based hunting has more analytical value than chasing isolated artefacts. The practitioner takeaway is that rule sets tied to static indicators will continue to decay faster than the threat.

AI-native hunting creates a more realistic operating model for browser defence. The issue is not whether a model can write detections, but whether the organisation can turn threat context into repeatable, testable detection logic at machine speed. That matters because browser attacks are now too dynamic for periodic, manually curated response cycles. Security teams should re-evaluate whether their detection engineering pipeline can learn quickly enough to stay inside the attacker’s mutation window.

Browser security and IAM are converging at the point where user interaction becomes authorisation. Consent prompts, federated login flows, and session abuse all sit in the browser, which means compromise can occur without traditional endpoint malware or perimeter breach. This is why browser security now affects identity assurance, session governance, and cloud access control together. Practitioners should design detection around identity-bearing browser behaviour, not isolated web events.

Adaptive browser hunting is now a category signal for the broader shift to behaviour-based security. The market is moving away from controls that only recognise known artefacts and toward systems that can reason over sequences, context, and intent. For identity leaders, that validates a broader governance direction: controls must observe how access is used, not merely whether an indicator matches. The practical conclusion is to align browser security, IAM telemetry, and incident response around the same behavioural evidence.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Browser security is now an identity-adjacent control plane. Once the browser carries authentication, consent, and cloud access flows, detection needs to observe identity-bearing behaviour rather than only web traffic. That means browser telemetry should be integrated with IAM and incident response instead of being treated as a separate endpoint stream.

Technique-level detection will matter more as AI lowers attacker friction. When campaign infrastructure changes faster than static indicators, security teams need detections that survive mutation. Behaviour-based hunting gives practitioners a way to keep pace without waiting for the same domain or URL to reappear in logs.

For practitioners

• Instrument browser telemetry as identity evidence Collect browser metadata that can support session, consent, and access-path analysis so identity-related behaviour is visible at the point of use.
• Prioritise technique-based detections Build detection content around TTPs such as consent phishing, device code abuse, and click-driven abuse patterns rather than relying only on IOC feeds.
• Link browser alerts to IAM workflows Route browser-originated detections into identity investigation, session review, and access revocation processes so response is not isolated in the browser tool.
• Test AI-assisted detection pipelines Validate whether detection engineering can ingest threat research, generate hypotheses, and produce usable detections quickly enough to keep pace with campaign mutation.

Key takeaways

• Browser attacks are increasingly defined by mutable technique patterns, which makes IOC-based detection too brittle for modern campaigns.
• Omdia-cited data in the source says 55% of organisations saw a successful or suspected browser-based attack in the last 12 months, and 88% now rank browser security among their top five priorities.
• The governance shift for IAM teams is to treat browser telemetry as part of identity evidence and to connect browser detections directly to session and access response.

Key terms

• Browser-Based Attack Vector: A browser-based attack vector is a path by which malware, ransomware, or other threats reach users through web activity and browser sessions. It matters because employees increasingly rely on browsers for SaaS and private applications, making browser security a core part of endpoint and identity protection.
• Technique-level detection: Technique-level detection identifies the method of attack rather than the artefact an attacker used to deliver it. In browser-based identity abuse, that means watching interaction sequences, redirect behaviour, and protocol misuse that remain stable even when infrastructure, domains, and frontends change.
• Browser telemetry: Browser telemetry is the event data produced by enterprise browser activity, including logins, profile changes, downloads, session starts, and extension or site interactions. In identity governance, it becomes useful when those events are correlated with account state and privilege context rather than treated as generic activity logs.
• Agentic Threat Hunting: A hunting model where AI agents help security researchers generate hypotheses, search telemetry, and triage results at scale. The human team still defines the context and validates the outcomes, while the agents reduce the time needed to move from signal discovery to production detection.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.