TL;DR: VDI is increasingly described as an expensive workaround for hybrid work because it adds server, license, and image-management overhead while still leaving shadow IT, browser-based AI tools, and unmanaged devices in play, according to Surf Security. The governance shift is toward session-level browser controls that can enforce policy on unmanaged endpoints without pretending the desktop boundary still works.
At a glance
What this is: This is an analysis of why VDI is losing fit for modern work and why browser-level policy enforcement is becoming the more credible control point.
Why it matters: It matters because identity and access teams need controls that follow the session, not just the device, when unmanaged endpoints and browser apps are part of the normal operating model.
Context
Virtual Desktop Infrastructure was built to centralise control around a managed desktop boundary, but that model becomes brittle when work has moved into SaaS, the browser, and unmanaged endpoints. The core governance gap is that desktop centralisation does not automatically equal control over the session where data is actually viewed, copied, and shared.
In practice, the access problem is no longer just whether a user has a desktop. It is whether policy can follow the browser session across BYOD devices, contractor devices, shadow IT, and browser-based AI usage without creating another heavy platform layer.
Key questions
Q: What breaks when organisations use VDI as a default for web-first work?
A: Costs rise, user experience suffers, and security control can become misplaced. A full desktop layer adds infrastructure, support, and maintenance overhead even when the real activity is happening in a browser. That mismatch encourages overprovisioning and makes policy harder to tune. Organisations often end up paying for a desktop abstraction they no longer need.
Q: Why do unmanaged endpoints create risk even when access is centralised?
A: Unmanaged endpoints still matter because centralised access does not guarantee centralised data handling. If the browser session is not governed, users can copy, download, or share sensitive information outside the intended policy envelope. The real risk is not device ownership alone, but whether the session carries enforceable controls.
Q: What are the signs that VDI is no longer the right access model?
A: Common signs include rising infrastructure cost, inconsistent user experience, heavy image maintenance, and growing use of browser apps that never need a full virtual desktop. If shadow IT and browser-based AI keep expanding anyway, the architecture is being used to contain a problem it no longer observes well.
Q: Should organisations replace VDI with browser-based developer controls?
A: Not automatically. Organisations should compare the security outcome, user experience, and operating cost of each model against their own risk profile. Browser-based controls can be a better fit when the main concern is preventing source code exfiltration, but they still require strong identity governance and device posture enforcement.
Technical breakdown
Why VDI breaks down as the browser becomes the workspace
VDI abstracts the desktop into a remote session, but it still depends on servers, images, GPUs, and network paths that must be provisioned and maintained. That architecture works poorly when the real application surface is SaaS and browser-delivered workflows, because the control plane sits too far from the point of use. The result is high overhead, variable performance, and limited visibility into what happens inside the browser session itself. For identity governance, the key issue is that desktop control does not equal data-flow control.
Practical implication: treat browser activity as the primary enforcement surface rather than assuming a remote desktop will absorb every access-control requirement.
How session-level browser controls change access governance
A secure browser shifts enforcement to the session, where access, download, copy, and navigation decisions can be applied dynamically. This matters because unmanaged devices and contractor endpoints do not disappear from the environment just because the desktop is virtualised. Session-level controls can reduce reliance on heavy infrastructure while still enforcing policy at the point where users interact with cloud apps and sensitive data. The browser becomes the control boundary, not merely the delivery mechanism.
Practical implication: evaluate whether your access policy can be enforced at session start, during use, and at data-exfiltration points without depending on endpoint ownership.
Shadow AI and unmanaged devices expose the limits of desktop-centric security
The article’s strongest point is not cost, but governance mismatch. Browser-based AI tools, shadow IT, and BYOD usage create activity that never meaningfully passes through a desktop boundary in a way VDI can fully govern. Once users can reach SaaS and AI tools directly from the browser, the security question becomes one of policy enforcement, data handling, and visibility in the session. That is an identity-and-access problem as much as a browser-security problem, because the user, device, and session all need to be evaluated together.
Practical implication: align browser controls with identity context so unmanaged endpoints and shadow AI are governed as session risk, not just device risk.
Threat narrative
Attacker objective: The objective is to exploit the gap between desktop centralisation and actual browser activity in order to reach data and workflows outside governance control.
- Entry occurs through unmanaged or BYOD endpoints that reach SaaS and browser-based AI tools without passing through a strongly governed desktop boundary.
- Credential or session abuse follows when access is granted to a browser session but data controls remain weak inside the workflow.
- Impact is policy bypass, shadow IT usage, and uncontrolled data movement that the VDI model cannot reliably see or stop.
Breaches seen in the wild
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Browser-level governance is replacing desktop centralisation as the practical control model. VDI was designed to concentrate risk into a managed environment, but modern work is already happening in SaaS, browser apps, and unmanaged devices. The governance question is no longer whether IT owns the desktop image, but whether it can enforce access and data rules inside the session. Practitioners should treat the browser as the control boundary when work has already moved there.
VDI’s main failure is a control mismatch, not just a cost problem. The article correctly points to infrastructure overhead, but the deeper issue is that centralising the desktop does not centralise the data flow. Shadow AI, shadow IT, and BYOD all create activity paths that sit outside the assumptions VDI was built on. Security teams should reassess which controls actually observe and govern user interaction, not just remote delivery.
Session context now matters more than device ownership. A managed device does not guarantee a managed workflow, and an unmanaged device does not have to mean unmanaged access if policy is enforced in the browser session. This creates a more useful governance model for hybrid work, but only if access, data handling, and user intent are evaluated together. Practitioners should move from endpoint-first thinking to session-first governance where it is justified.
Shadow AI is the clearest sign that browser governance is now an identity problem. Once users can access AI tools directly in the browser, the risk is not only data leakage but unsupervised access behaviour that the old desktop perimeter never saw. That makes browser security, identity context, and data handling part of the same control discussion. Teams should frame browser policy as part of IAM and data governance, not as a standalone convenience layer.
What this signals
Session-first governance is becoming the more credible model for hybrid work. When the browser is the workspace, security teams need controls that travel with the session rather than controls that stop at the virtual desktop boundary. That shift changes how IAM, DLP, and access governance should be combined for unmanaged endpoints.
Browser governance is now part of identity governance. The article’s real implication is that user identity, device posture, and session rules are converging in the browser. Practitioners should design for that convergence instead of treating remote access, SaaS use, and data control as separate problems.
For practitioners
- Assess where VDI is acting as a proxy control Map which access, data, and compliance requirements are only being met because users are forced into a virtual desktop. Separate those from controls that can be enforced directly in the browser session.
- Define browser-session policy for unmanaged endpoints Set policy for copy, download, upload, clipboard, and navigation controls based on identity context and data sensitivity, not on whether the endpoint is corporate-owned.
- Classify shadow AI and SaaS access as governance scope Inventory browser-based AI tools and other unmanaged web workflows, then decide which sessions require stronger monitoring or restriction because they bypass the desktop boundary.
- Re-evaluate remote access architecture Compare the operational cost and control coverage of VDI against browser-native enforcement for the applications your workforce actually uses.
Key takeaways
- VDI is under pressure because it governs the delivery layer more easily than it governs the browser session where work now happens.
- The main risk is not only cost and complexity, but the fact that shadow IT, browser AI, and unmanaged devices can bypass the intended desktop boundary.
- Browser-native session controls offer a more practical way to enforce policy across hybrid work when identity, data handling, and access need to stay aligned.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about where access control is enforced in hybrid work. |
| Recommendation — Apply PR.AA-05 to ensure browser sessions enforce access and entitlements directly. | ||
| CIS Controls v8 | CIS-5 — Account Management | Browser-based access expansion changes how accounts and sessions must be governed. |
| Recommendation — Use CIS-5 to review how accounts are governed across managed and unmanaged browser sessions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article touches session access and the governance of credentials behind browser access. |
| Recommendation — Apply IA-5 to tighten authenticator lifecycle controls for browser-mediated access. | ||
| NIST Zero Trust (SP 800-207) | Core principles — Core principles | The browser-as-control-boundary model aligns with continuous verification and session-level enforcement. |
| Recommendation — Use zero-trust principles to move policy enforcement from the desktop image to the active session. | ||
Key terms
- Virtual Desktop Infrastructure: Virtual Desktop Infrastructure is a centralised desktop delivery model that streams or hosts user desktops from a server environment. It can simplify some management tasks, but it often adds cost and complexity when the real work takes place in browser-based applications rather than in the desktop itself.
- Session-level control: Session-level control is the ability to govern what a user, service, or agent can do during an active login or connection. It applies policy after authentication, using signals such as risk, device state, time, and action type to allow, restrict, step up, monitor, or terminate activity in real time.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Browser-Native Security: Browser-native security is the practice of enforcing security controls directly in the web browser, where users, sessions, and web applications actually interact. It applies policy, identity checks, data protection, and threat detection at the browser layer, using the browser as a control point for access, isolation, and monitoring.
Deepen your knowledge
NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management in the contexts that matter to modern access control. It is designed for practitioners who need to connect identity governance with broader security operations and policy enforcement.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org