TL;DR: Unmanaged endpoints widen the attack surface for remote work because credentials, tokens, cookies, and session data can be exposed outside IT control, while unmanaged or poorly managed devices are implicated in 80% of ransomware attacks and 71% more malware exposure, according to CyberArk and Microsoft Digital Defense Report 2023. The security issue is not remote access itself, but the lack of device trust, session control, and credential governance around it.
At a glance
What this is: CyberArk’s article says unmanaged laptops and other personal endpoints create a governance gap for NHI access by exposing credentials, sessions and API keys outside IT control.
Why it matters: This matters because identity teams have to govern access that starts on devices they do not own, which changes how NHI, contractor and workforce controls are enforced.
By the numbers:
- 80% of ransomware attacks originate from unmanaged devices, with 60% of those leveraging remote encryption, according to CyberArk.
- Users on unmanaged devices are 71% more likely to face malware, according to CyberArk.
- Nearly 70% of organizations have been victimized by cyberattacks exploiting unmanaged or poorly managed devices, according to CyberArk.
Context
Unmanaged endpoints are personal or third-party devices used to reach corporate systems without the organisation owning the device or fully controlling its posture. In this article, the primary gap is not access to SaaS itself, but the absence of device trust, session control and credential governance once work moves onto laptops outside IT oversight.
That gap matters most in hybrid work and extended-workforce scenarios, where employees, contractors and third parties use unmanaged workstations to reach sensitive applications. When the endpoint is outside control, the organisation may still authenticate the user or workload, but it loses the assurance that credentials, cookies, session state and data are being protected at the point of use.
The article’s core claim is that unmanaged access becomes dangerous when governance stops at login and does not continue through the session and credential lifecycle. That is a typical condition in modern remote work environments, not an edge case.
Key questions
Q: What breaks when teams manage SaaS, cloud, and endpoint access separately?
A: What breaks is the defender’s view of the intrusion. Separate teams may each see a normal event, while the attacker is chaining those same events into a single path. That disconnect allows token reuse, session abuse, and cross-platform movement to continue until the damage is already done.
Q: Why do unmanaged endpoints increase the risk of credential theft and session abuse?
A: They increase risk because the local device can store or expose reusable artefacts that belong to the identity session, not just the user. If a laptop is untrusted or shared, attackers can target cached passwords, tokens or remote support pathways and then operate as an authorised session participant.
A: Organisations should treat contractor access as a governed identity and application problem, not just an onboarding task. The practical baseline is least privilege, tightly scoped credentials, strong session controls, and continuous revocation. Personal devices can speed productivity, but they increase exposure unless access is limited to approved applications, monitored in real time, and removed immediately when the engagement ends.
Q: Should organisations prioritise browser controls or password controls for unmanaged endpoints?
A: They need both, but browser controls usually reduce risk first because they prevent passwords and cookies from persisting on the unmanaged device. Password controls still matter, yet they do not solve the wider problem of session exposure once the browser is open and active.
Technical breakdown
Why unmanaged endpoints create a trust gap for NHI access
An unmanaged endpoint is a device the organisation does not administer, harden, or continuously monitor. That matters because modern access flows often depend on bearer artefacts such as cookies, tokens, API keys and cached credentials. If those artefacts live on a personal laptop, the device becomes part of the trust boundary even though it is outside the trust model. For NHI governance, the problem is not only who is entitled to access. It is whether the endpoint can protect the credentials and session state that make that access possible. Practical implication: treat unmanaged endpoints as a distinct control plane, not just another user context.
Practical implication: classify unmanaged devices as an access-risk boundary and apply controls that do not assume endpoint ownership.
How secure browser controls change credential exposure
The article describes a secure browser pattern that avoids exposing passwords and cookies on the unmanaged workstation. In practice, this means the browser becomes a controlled intermediary: credentials are not entered directly into the local endpoint, cookies are not persisted there, and access can be mediated through tokens or approved application flows. This reduces the chance that a stolen laptop or malicious local software can harvest reusable credentials. The important point is that the control limits exposure at the browser layer, where most remote work now happens. Practical implication: move sensitive access flows into controlled browser mediation rather than relying on endpoint hygiene alone.
Practical implication: route sensitive SaaS access through controlled browser sessions so secrets never land on the unmanaged device.
Why session control matters more than login control
A session can remain active long after authentication succeeds, which is why unmanaged endpoints create a governance gap after the password check is finished. Continuous authentication, audit logging, data exfiltration protection and session recording extend oversight into the live session, where copying, downloading or lateral use of data can occur. That is especially relevant when contractors or third parties access critical business applications from devices the organisation cannot inspect. In identity terms, the control target shifts from initial authentication to session governance. Practical implication: secure the session lifecycle, not just the sign-in event.
Practical implication: monitor and constrain active sessions so data loss controls continue after authentication succeeds.
Threat narrative
Attacker objective: The attacker aims to harvest reusable access artefacts or abuse unmanaged session access to reach sensitive corporate data without triggering endpoint controls.
- Entry occurs when users, contractors or third parties access SaaS and business applications from unmanaged endpoints outside IT control.
- Credential and session artefacts such as tokens, cookies and passwords are exposed on the local device or intercepted through the browser and remote support path.
- The attacker abuses a stolen remote support API key or harvested artefacts to access documents and move through the session as an authorised user.
- Impact follows when sensitive data is exposed or exfiltrated from the unmanaged workstation and the organisation cannot reliably contain the device-side compromise.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Unmanaged endpoints turn the device into part of the identity control plane: When access happens from personal or contractor-owned hardware, the organisation is no longer governing only the user or the NHI. It is also relying on a device it does not control to protect the artefacts that make access possible. That is why unmanaged endpoint risk is an identity governance problem, not just an endpoint hygiene problem. Practitioners should treat device trust as a prerequisite for access governance, not an afterthought.
Credential exposure on unmanaged endpoints creates persistent identity debt: Passwords, cookies, tokens and API keys stored or handled on personal devices outlive the authentication event that created them. That creates a reuse window that traditional sign-in controls do not cover. The field should recognise this as a lifecycle failure, because access is being granted without a governable boundary at the point where credentials are actually consumed. Practitioners need to rethink how entitlement, session and device controls intersect.
Session governance is now the decisive control layer for hybrid work: The article makes clear that authentication alone does not protect data once a session is open on an unmanaged endpoint. Continuous authentication, audit trails and exfiltration controls matter because they govern what the user can do after login. That shifts the control conversation from access approval to in-session assurance, which is where many identity programmes remain weakest. Practitioners should evaluate whether their current controls still assume a managed endpoint by default.
Third-party access on unmanaged devices exposes governance gaps in offboarding and oversight: Contractors and external collaborators often need access before IT has full visibility, which makes unmanaged endpoint access a lifecycle problem as much as a technical one. If access is not tied to device trust, session control and explicit accountability, governance stops at the edge of the organisation. The implication is that NHI and human access programmes must converge on the same question: who is accountable for access when the endpoint is outside the control boundary?
Device trust is the new prerequisite for least privilege in remote work: Least privilege is no longer only about what the identity can reach. It is also about where and under what device conditions that identity is allowed to operate. When the endpoint is unmanaged, privilege can no longer be assumed to remain contained by policy alone. Practitioners should re-evaluate privilege models that do not express endpoint posture as part of authorisation.
What this signals
Unmanaged endpoint governance has become an access architecture issue, not a device-support issue: Hybrid work has normalised remote access from devices that the organisation cannot fully harden or inspect. That means authorisation models must account for device trust at the point of access, not assume the endpoint will be safe because the user is known.
Session controls are now the practical boundary for remote identity governance: When credentials and cookies are already outside the organisation’s direct control, the only reliable place to impose policy is inside the live session. Practitioners should expect more emphasis on continuous authentication, browser isolation and session recording as the default posture for high-risk access paths.
Endpoint ownership is becoming a governance variable in third-party access: Contractors and external collaborators are not just another user population. Their device context changes the risk profile of the same application, which means offboarding, review cycles and access approvals need to reflect where and how access is being consumed.
For practitioners
- Define unmanaged endpoints as a separate access-risk tier Inventory where employees, contractors and third parties access sensitive SaaS from personal or shared devices, then assign stronger controls to those flows than to managed endpoints.
- Move sensitive browser sessions into controlled pathways Use secure browser mediation for high-risk applications so cookies, passwords and other reusable artefacts do not persist on the local workstation.
- Extend monitoring beyond initial authentication Require continuous authentication, full audit trails and session recording for unmanaged-device sessions that reach critical business systems.
- Reduce standalone credential exposure on remote devices Prefer token-based access and automatic credential rotation where unmanaged endpoints are unavoidable, so stolen local credentials have less value.
- Tighten third-party access governance Apply explicit offboarding and access review steps to contractors and external collaborators using unmanaged workstations, because device ownership does not remove accountability.
Key takeaways
- Unmanaged endpoints create an identity governance blind spot because access artefacts can be exposed on devices the organisation does not control.
- CyberArk cites Microsoft Digital Defense Report 2023 figures showing 80% of ransomware attacks originate from unmanaged devices and users on unmanaged devices are 71% more likely to face malware.
- The practical response is to govern access through device trust, browser mediation and session controls, not just through authentication at login.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on credential and session exposure from unmanaged endpoints. |
| NHI-10 — Human Use of NHI | The article discusses people handling credentials and tokens on personal devices. | |
| Recommendation — Reduce insecure authentication by mediating remote access through controlled browser and session layers. Separate human device use from NHI credential handling to prevent artefact exposure on unmanaged endpoints. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential rotation and secure storage are directly discussed for remote access on unmanaged devices. |
| Recommendation — Apply authenticator management to rotate exposed credentials and keep them off unmanaged devices. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who can access what from unmanaged devices. |
| Recommendation — Tie entitlements to device trust so unmanaged endpoints do not receive the same access path as managed ones. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The incident pattern includes exposed credentials and reuse of remote access artefacts. |
| Recommendation — Map unmanaged endpoint exposure to credential access and lateral movement techniques in detection and response. | ||
Key terms
- Unmanaged Endpoint: A device that the organisation does not fully administer, monitor, or harden under its standard endpoint controls. In practice, this includes personal laptops and shared computers used for corporate access, where local storage, browser state, and device posture may not meet enterprise trust requirements.
- Session Governance: The practice of binding access to a specific task, time window, and execution context, then revoking it when the work is done. For non-human identities, session governance matters because tokens and delegated permissions often persist longer than the action they were created to support.
- Secure Browser Mediation: A pattern that routes access through a controlled browser layer so passwords, cookies and other reusable artefacts do not persist on the local device. It is especially useful when the endpoint is personal, shared or otherwise outside IT control.
- Device Trust: Device trust is the confidence that a requesting endpoint is known, managed, and in a compliant state. It matters because identity alone does not prove safety. In zero trust programmes, device trust becomes one of the inputs used to decide whether access should be granted or sustained.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 1, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org