Browser-based privileged access leaves a PAM governance gap

At a glance

What this is: This is an analysis of browser-based privileged access and the gap it creates when PAM controls stop at traditional remote sessions.

Why it matters: It matters because IAM and PAM teams now have to govern high-risk browser sessions for cloud, SaaS, and administrative portals, not just SSH and RDP.

By the numbers:

• 95% of organisations experienced a browser-originated attack in the past year, according to Wallix.
• 94% reported phishing incidents, according to Wallix.
• 64% of encrypted web traffic goes uninspected in most organisations, according to Wallix.
• organisations faced an average of 1,984 cyberattacks per week in Q2 2025, according to Wallix.

Context

Browser-based privileged access means high-risk administrative work now happens inside web applications, not only through SSH or RDP. Cloud consoles, admin portals, SaaS dashboards, and industrial control interfaces can all execute privileged actions, but many governance programmes still treat them as ordinary browser traffic rather than governed sessions.

That gap matters because the browser sits between the user, the device, and the target application, which makes it a natural place for credential theft, session hijacking, and unauthorised actions to unfold. For NHI, PAM, and broader IAM programmes, the problem is not that browser use is new. The problem is that critical privilege has moved into a channel many controls were never built to inspect.

The article's starting position is typical across organisations that matured PAM around infrastructure first. Many teams secured remote shells and desktop sessions, then left web-based administration outside the same control envelope.

Key questions

Q: Where does PAM fail when administrators work through browsers?

A: PAM fails when it assumes privileged work only happens in SSH, RDP, or database sessions. Browser-based administration often remains authenticated but ungoverned, so security teams lose session recording, granular action control, and the review evidence they rely on for high-risk access governance.

Q: Why do browser-based admin sessions increase operational risk?

A: Because the browser can carry privileged action paths, session tokens, and sensitive application state in a way older access models do not isolate. If those sessions are hijacked or reused, attackers can perform administrative actions inside trusted portals without needing a new login event.

Q: What are the signs that web-based privileged access is under-governed?

A: Common signs include admin portals with no session recording, browser access that bypasses endpoint controls, and no restriction on clipboard or file transfer during high-risk work. If teams cannot reconstruct what happened inside the session, governance is already incomplete.

Q: How should teams govern browser-based privileged access across cloud and SaaS tools?

A: Treat web-based administration as privileged access, define which applications and actions are in scope, and apply the same review and control expectations used for other elevated sessions. Governance should follow the work, not the protocol used to reach it.

Technical breakdown

Why browser sessions create a privileged access blind spot

A browser session can carry the same business risk as a server shell when it is used to administer cloud consoles, firewalls, SCADA dashboards, or identity portals. The technical issue is that most PAM tooling was designed around explicit session types such as SSH and RDP, where the session boundary is obvious and easy to record. Browser-based work often uses standard HTTPS and shared application paths, so privilege is embedded in normal web workflows rather than isolated in a distinct remote session. That makes control points harder to see, especially when authentication happens once and the user can perform many sensitive actions afterwards.

Practical implication: Map browser-based administration to the same governance tier as remote privileged sessions, not to generic web access.

How session hijacking and token theft change the control problem

Browser access concentrates value in cookies, bearer tokens, and active application sessions, so compromise often looks less like password theft and more like session reuse. Once an attacker inherits a live session, the application may trust the browser without rechecking the user's intent or device state. That is why granular authorisation inside the application matters as much as initial authentication. In a browser-mediated workflow, credential theft, token theft, and unauthorised action often sit on the same path because the browser itself becomes the execution surface for privilege.

Practical implication: Treat session recording, step-up checks, and bounded permissions as browser-session controls, not only as identity controls.

Why encrypted web traffic visibility is a governance issue

When encrypted web traffic is left uninspected, security teams lose the ability to see what privileged users are actually doing inside browser-delivered admin tools. The issue is not encryption itself but the absence of a governance layer that can observe sensitive transactions without breaking the user experience. If privileged access is occurring through web apps, visibility has to extend beyond authentication success to the actions taken after login. Otherwise, audit trails, anomaly detection, and incident review all start from an incomplete record.

Practical implication: Instrument browser-delivered admin activity with audit-grade session visibility and application-level logging.

Threat narrative

Attacker objective: The attacker aims to abuse trusted browser-based administrative access to change systems, steal data, or expand control without triggering traditional PAM oversight.

1. Entry occurs through a browser session into a cloud console, SaaS admin portal, or other web-based privileged interface rather than through a traditional remote shell.
2. Credential theft, phishing, or session token theft enables an attacker to inherit a live browser session or reuse authenticated access without tripping older PAM controls.
3. Once inside, the attacker can perform unauthorised administrative actions, exfiltrate data, or move laterally through other web-managed systems that trust the same access path.
4. The end result is privileged misuse that remains outside the monitoring and recording model many organisations still reserve for SSH and RDP.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-based privileged access is now a PAM governance problem, not a web-security edge case: The control model that grew up around SSH and RDP no longer captures where administrators actually act. Cloud consoles, ERP portals, identity dashboards, and industrial web interfaces all execute privileged actions, so the browser has become part of the privileged access plane. The implication is that PAM scope must be defined by privilege, not by protocol.

The real gap is session governance, not login governance: Many programmes authenticate the user but fail to govern the actions that follow inside the web application. That leaves a blind spot where session hijacking, clipboard abuse, file transfer, and silent administrative changes can all happen after initial access. Practitioners need to treat post-login control as the deciding boundary for browser-based privilege.

Web session security creates a distinct control category for modern PAM: This is not just another access path to instrument, it is a governed workspace that needs recording, restriction, and auditability. Session isolation, granular permissions, and browser-level oversight are no longer optional refinements when critical work lives in SaaS and cloud portals. Teams that do not classify browser administration as privileged work will continue to undercount their real attack surface.

Browser-originated attack volume exposes a control assumption gap: The security assumption that high-risk activity can be confined to a few inherited remote session types was designed for infrastructure-centric administration. That assumption fails when administrators routinely use the browser as the primary control surface for sensitive systems. The implication is that access governance must follow the work, not the transport.

Web session security gap: Privilege now travels through a governed workspace that most PAM programmes still treat as untrusted general browsing. That mismatch creates an identity and audit gap at the exact point where administrators make changes with lasting operational impact. Practitioners should reframe browser use as part of privileged access governance, not as a separate security domain.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
• Read next: Cloud PAM and CIEM Guide

What this signals

Browser session governance is the missing control layer: Organisations have already accepted that administrators can manage critical systems from SaaS and cloud consoles, but many still lack a policy boundary for those sessions. That leaves a gap between authentication and actual administrative authority, which is where privileged misuse tends to hide.

Web session security gap: The browser should be treated as a governed workspace whenever it carries administrative authority, not merely as a transport to an application. Security teams that define privilege by protocol will keep missing the controls needed for modern cloud and SaaS operations.

For practitioners

• Classify browser administration as privileged access Inventory cloud consoles, SaaS admin portals, ERP interfaces, and industrial web dashboards as privileged channels and bring them under PAM policy.
• Extend session recording to web sessions Capture browser-based privileged actions with video, metadata, and action logs so review evidence exists after the session ends.
• Apply granular controls inside web applications Restrict clipboard, file transfer, printing, and other sensitive operations by application and by role, not only by login identity.
• Isolate browser-based admin work from the local device Use secure remote environments or equivalent isolation so code, malware, and credentials do not land on unmanaged endpoints.
• Inspect encrypted web traffic where privileged work occurs Prioritise visibility into encrypted browser traffic for admin portals and cloud consoles so stealthy actions are not hidden behind TLS.

Key takeaways

• Browser-based administration creates a privileged access gap when PAM programmes stop at SSH and RDP.
• The article shows that web-originated attacks and uninspected encrypted traffic make browser sessions a practical blind spot for governance.
• Teams need to bring browser sessions into the same recording, restriction, and review model they already expect for other elevated access paths.

Key terms

• Browser-Based Privileged Access: Browser-based privileged access delivers high-risk access through a hardened browser session instead of a local client or VPN. The model reduces endpoint dependence and can simplify third-party onboarding, but it shifts control requirements to isolation, revocation, and strict session enforcement inside the browser boundary.
• Web Session Security: The control discipline for governing what happens after a user authenticates into a browser-delivered application. It focuses on session isolation, recording, and action-level restrictions so that privileged activity remains observable and bounded during the session.
• Browser-Originated Incident: A browser-originated incident is a security event that begins in the browser and then affects credentials, data, or business workflows. For identity teams, it signals that the browser has become an operational control point rather than a neutral access layer.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.