Enterprise browsers and compromised credentials: what changes for IAM

At a glance

What this is: This is an analysis of why compromised credentials still bypass modern defenses and how browser-layer controls change the control surface for identity security.

Why it matters: It matters because IAM, PAM, and NHI programmes increasingly fail at the point where credentials are entered, stored, or replayed, not at initial authentication.

By the numbers:

• Researchers recently found that 25% of the malware they collected in 2024 was designed to steal user credentials.
• In 2024, 67% of healthcare organizations were hit by ransomware, resulting in disruptions in patient care and recovery payouts averaging $2.57 million.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
• 28% of secrets incidents now originate outside code repositories and are 13% more likely to be categorised as critical than code-based leaks.

👉 Read Island's analysis of how browser controls reduce compromised credential risk

Context

Compromised credentials remain one of the most reliable paths into enterprise systems because authentication does not end when a password is accepted. Credentials can be phished, reused, extracted from browsers, replayed through session theft, or abused through third-party access, which means the control problem extends across identity, endpoint, and browser layers. For IAM teams, the issue is less about proving login and more about constraining what happens after login.

The article argues that traditional browsers leave too much room for credential misuse because they were not designed as enterprise control points. That is a familiar failure pattern in identity programmes: authentication succeeds, but the browser, session, and downstream application remain outside enforced governance. For human IAM, that creates exposure; for NHI-adjacent workflows and delegated access, it creates a wider trust boundary than most teams assume.

Browser-mediated access is now part of the identity perimeter. As enterprises blend SaaS, privileged workflows, third-party support access, and remote work, the browser becomes a practical enforcement point for step-up authentication, session control, credential protection, and extension governance. That makes this topic relevant across human identity, PAM, and broader identity lifecycle management.

Key questions

Q: How should security teams reduce the risk of compromised credentials in browser-based access?

A: Security teams should combine browser restrictions, step-up authentication, and mediated credential handling. The goal is to prevent raw secrets from being stored, copied, or replayed in environments the enterprise does not control. If the browser is part of the access path, it must also become part of the policy boundary.

Q: Why do compromised credentials often bypass MFA controls?

A: Because many attacks steal the artifact issued after MFA, not the password itself. If an attacker reuses a session cookie, OAuth token, or refresh token, the login appears already authenticated. MFA was satisfied earlier, so the control did its job but did not protect the downstream artifact from replay.

Q: What do teams get wrong about browser controls and identity governance?

A: Teams often assume that strong login controls are enough, but the risk usually appears after authentication, inside the session. If browser activity is not governed, users can still copy, export, or move data outside approved workflows, even when access decisions were correctly made at sign-in.

Q: Who is accountable when third-party credentials are used to reach enterprise systems?

A: Accountability sits with both the organisation granting access and the party operating it. Identity governance must cover onboarding, scope, monitoring, and offboarding for every delegated account, especially support engineers and contractors. If those lifecycles are unclear, the enterprise has no reliable control over blast radius.

Technical breakdown

Why browser-based credential theft still works

Credential theft persists because attackers target the places where secrets are exposed, not just the login form. Phishing, autofill abuse, malicious extensions, cookie theft, and man-in-the-browser malware all exploit the gap between authentication and session control. In practice, a browser can store, replay, or expose sensitive material in ways that bypass MFA once the initial challenge is complete. That is why password reuse, local credential storage, and unmanaged browser environments remain high-value attack paths. The technical problem is not just authentication strength, but whether the browser itself is allowed to become a credential source.

Practical implication: treat the browser as an identity control surface and restrict where credentials can be entered, stored, and replayed.

How presentation-layer MFA changes enforcement

Presentation-layer MFA means the browser can assert authentication requirements even when the application itself does not enforce them well. This matters for legacy SaaS, high-risk internal systems, and applications that only check identity at initial logon. By re-verifying user identity when context changes, the browser can narrow the session trust window and reduce the value of stolen credentials. The architecture is not replacing the identity provider. It is enforcing identity policy at the point where application access is actually consumed, which helps close gaps left by inconsistent app-native controls.

Practical implication: map your highest-risk applications and decide where browser-enforced step-up authentication is needed.

Why zero-knowledge PAM and inline password transformation matter

Zero-knowledge privileged access management avoids exposing shared passwords to users, while inline password transformation injects credentials at runtime so the user never handles the secret directly. That changes the threat model from password possession to controlled access mediation. It is especially relevant where shared accounts, delegated admin functions, or temporary access are unavoidable. These controls reduce accidental disclosure, limit insider misuse, and make credential theft harder to operationalise because there is no raw secret for the user to copy, leak, or reuse.

Practical implication: replace shared-password workflows with mediated access paths wherever privileged or shared access still exists.

Threat narrative

Attacker objective: The attacker wants to turn a stolen credential into persistent, low-friction access that survives basic authentication checks and reaches high-value systems.

1. Entry occurs through credential harvesting, phishing, autofill abuse, or third-party account compromise, giving the attacker valid authentication material.
2. Escalation follows when the attacker reuses the stolen credential, bypasses weak MFA interactions, or exploits a trusted browser session.
3. Impact is unauthorized access to SaaS, internal systems, or privileged workflows, often with data theft, account takeover, or lateral movement into adjacent services.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-layer governance is now part of identity security, not a usability concern. The article correctly shows that compromise often happens after authentication, when credentials are stored, replayed, or exfiltrated through the browser. That means IAM teams cannot treat browser behaviour as outside the identity stack. The practical conclusion is that identity policy must follow the session into the browser.

Compromised credentials expose a persistence problem, not just an access problem. Once a password or token is stolen, the attacker can use it repeatedly until the secret is rotated or the session is invalidated. That is a governance failure across human identity, privileged access, and shared access workflows. The implication is that standing trust in reusable credentials remains a structural weakness.

Presentation-layer enforcement is a control model, not a product feature. The article points to a broader shift: identity controls increasingly need to operate where applications and browsers intersect, because that is where phishing, autofill abuse, and session hijacking manifest. Organisations should treat step-up checks, browser restrictions, and credential mediation as part of the identity architecture rather than endpoint decoration.

Third-party access expands the blast radius of compromised credentials across the supply chain. The Okta example reflects a familiar pattern in identity governance: a smaller trust boundary is used to reach a much larger one. When support engineers, contractors, or delegated admins carry access into critical systems, the lifecycle of that access matters as much as the password itself. The practitioner takeaway is that offboarding and access scoping must extend to the entire delegated chain.

Identity blast radius is the right concept for this problem. Compromised credentials are dangerous because they collapse the distance between a single login event and broad enterprise exposure. The issue is not only whether the credential is valid, but how far that validity travels across apps, devices, and partners. Teams should measure how much access a stolen credential can unlock before it is blocked.

From our research:

• 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
• If browser-layer exposure is the entry point, the Guide to the Secret Sprawl Challenge shows how to reduce the credential surface before attackers can reuse it.

What this signals

Identity teams should start treating the browser as a governed control plane. Once credentials are exposed, the attack path is often a race between attacker reuse and enterprise revocation. That is why browser restrictions, step-up authentication, and session-bound access need to sit inside the same governance model as password policy and privileged access, not beside it.

Browser control becomes more valuable as shared access and third-party access increase. The more your programme relies on contractors, support engineers, and privileged browser sessions, the more blast radius depends on access scope and offboarding discipline. Teams that already use the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs should apply the same lifecycle logic to delegated human access patterns.

Compromised credentials also expose a measurement problem: many organisations still track authentication success but not post-login exposure. The useful question is how much access a stolen browser session can unlock before containment, which should be visible through session telemetry, privileged access logs, and application-level step-up events.

For practitioners

• Constrain where credentials can be entered Block unmanaged browsers from sensitive applications and enforce browser-controlled access paths for privileged workflows and SaaS apps that hold business-critical data.
• Mediate shared and privileged credentials Replace password sharing with zero-knowledge privileged access patterns so users never handle raw secrets and shared accounts are not exposed during normal work.
• Recheck identity at session risk changes Use step-up authentication when users move into higher-risk application areas, change device posture, or access data that materially increases exposure.
• Audit third-party access lifecycles Review support, contractor, and partner access for offboarding gaps, stale entitlements, and overbroad delegated privileges that outlive the business need.
• Reduce browser credential exposure Disable credential storage and autofill in environments where the browser can be used to extract passwords, tokens, or session cookies.

Key takeaways

• Compromised credentials remain effective because the browser, session, and delegated access paths still sit outside many identity controls.
• Attackers do not need to defeat MFA if they can steal, replay, or socially engineer access after authentication.
• The practical response is to govern the browser as part of IAM, PAM, and access lifecycle control, not as an unmanaged edge layer.

Key terms

• Presentation-Layer MFA: A control pattern where the browser or access layer asserts additional authentication requirements before a user reaches a sensitive application area. It matters when the application itself does not enforce context-aware checks, because the browser becomes the point where identity policy is applied during the session.
• PAM — Privileged Access Management: Solutions that control, monitor, and audit privileged access for both human and non-human identities. Traditional PAM tools are being extended to cover machine identities, service accounts, and agentic AI workloads.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Browser Governance: The policy and control layer that manages how credentials, sessions, extensions, downloads, and authentication challenges behave inside the browser. It turns the browser from an unmanaged endpoint into part of the identity boundary, which is increasingly necessary for SaaS and privileged web access.

What's in the full article

Island's full post covers the operational detail this post intentionally leaves for the source:

• Browser enforcement patterns for blocking unmanaged access to high-risk SaaS applications
• Zero-knowledge privileged access workflows for shared accounts and delegated admin use cases
• Inline password transformation and credential injection mechanics across legacy and modern web apps
• Malicious extension detection logic and dynamic risk scoring for browser governance

👉 Island's full post covers the browser enforcement model, credential protections, and access scenarios in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity programme, it is worth exploring.