Why SaaS and AI security now hinge on identity and browser context

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Valence Security's blog post: SaaS and AI risk converged in 2025, with identity, OAuth, browser sessions and agent activity becoming the main security boundary.

Why it matters: IAM, PAM and NHI teams need to treat browser context and delegated access as first-class controls because traditional perimeter thinking no longer matches how SaaS and AI are actually used.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.

Context

SaaS and AI security now revolves around identity context, not just application inventory. When access is granted through browser sessions, OAuth grants and embedded AI features, security teams need to understand who or what is acting, what can be reached, and how far a trusted session can propagate.

The governance gap is that modern SaaS estates behave like interconnected identity systems rather than isolated apps. That makes browser context, delegated access and identity lifecycle control central to both human IAM and NHI governance, especially as AI agents begin to operate across the same surfaces.

Key questions

Q: What breaks when SaaS access is governed only at the account level?

A: Account-level governance misses the session, grant and integration layers where SaaS access is actually exercised. That leaves security teams able to see who has a permission, but not how far that permission can propagate through connected apps, browser sessions or delegated workflows. The result is a false sense of control and slower containment when trust is abused.

Q: When does OAuth create more risk than it reduces in SaaS environments?

A: OAuth becomes high risk when scopes are broad, tokens are long-lived, and the organization cannot see how the credential is reused across connected apps. At that point, convenience outweighs control, and a stolen token can preserve trusted access without repeated authentication.

Q: What are the signs that browser-based AI automation is being misused against SaaS accounts and social platforms?

A: Common signals include rapid login attempts across many apps, unusual joining of communities or channels, repeated account creation, and outbound messages that closely match a target’s recent posts or interests. Security teams should also watch for phishing activity delivered through IM platforms and social media, where traditional email-focused controls may not apply as effectively.

Q: How should organisations govern SaaS-based AI agents when they do not control the runtime environment?

A: Organisations should treat SaaS agents as shared-control systems and insist on runtime policy that covers data access, tool use, downstream actions, tenant isolation, and auditability. The practical test is whether the enterprise can enforce its own rules even when the vendor owns the execution environment. If it cannot, the agent is configurable, but not truly governed.

Technical breakdown

OAuth grants and browser sessions create the real trust boundary

In SaaS environments, the browser and the OAuth grant often become the effective control plane. A user signs in through a session, authorises access, and that delegated authority can outlive the original interaction through refresh tokens, embedded app permissions or connected workflows. This is why SaaS compromise rarely depends on a single application flaw. The security problem is the accumulation of trust across identity, session and integration layers. Once an attacker or rogue workflow inherits that trust, the platform can expose data and actions far beyond the initial app boundary.

Practical implication: Treat OAuth grants and browser sessions as governed access surfaces, not just authentication artefacts.

AI agents inherit SaaS risk through non-human identities

The article’s core AI point is that agents are entering SaaS through the same identity and integration paths as users, but they can act at machine speed and across many systems. That makes them operationally different from simple automation. The governance issue is not only whether an agent has access, but how trust is delegated, how broad that access becomes, and how quickly the resulting action chain can spread. In practice, AI agents sit inside NHI governance even when they are embedded in familiar SaaS workflows.

Practical implication: Inventory AI agents as non-human identities and review their delegated scope separately from human user access.

Browser context is becoming a security signal, not a convenience layer

Browser telemetry matters because many SaaS and AI interactions are now visible only at the session level. The browser reveals active context such as user behaviour, session continuity, and real-time tool use that APIs alone do not expose. That matters for detecting misuse, understanding intent and identifying exposure when an apparently legitimate session begins behaving like a risk event. Without browser context, security teams see permissions but not how those permissions are being exercised. That leaves a blind spot in both incident response and access governance.

Practical implication: Use browser-level signals to validate whether access is being exercised in ways that match policy and role expectations.

Threat narrative

Attacker objective: The attacker wants to turn trusted SaaS identity and integration paths into broad downstream access across connected systems and customers.

1. Entry occurs through browser-based adoption, OAuth integration or trusted SaaS access rather than through a conventional perimeter breach.
2. Credentialed access or delegated trust is then abused through tokens, sessions or integrations that already carry authority across connected systems.
3. Escalation happens when that trusted access propagates into downstream SaaS tenants, workflows or connected customer environments.
4. Impact is ecosystem-wide exposure, where one compromise can cascade into multiple organisations and SaaS services.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser context has become part of identity governance: The SaaS control boundary no longer sits at the login screen. It now includes the browser session, the OAuth grant and the downstream integrations that inherit that trust. Security programmes that treat those layers as separate will miss how access is actually used, so practitioners need to govern the session as carefully as the account.

AI agents are not a separate risk category from NHI, but they intensify NHI governance failures: Agents enter SaaS through delegated identity, then act at machine speed across multiple systems. That means NHI oversight must move from static inventory to scope, delegation and action-path control, or autonomous behaviour will outrun review cycles.

Trusted integrations are now the main blast-radius amplifier: The article’s breach examples show that modern SaaS compromise spreads through grants, connectors and shared business workflows rather than isolated hosts. That changes the governance problem from single-account protection to ecosystem containment, where one over-broad grant can become many organisations' exposure.

Delegated access without browser-level context creates an identity blind spot: Access reviews and posture checks can confirm that a permission exists, but not whether it is being exercised through a compromised session, a misused token or an AI-driven workflow. The implication is that identity governance must account for runtime behaviour, not just entitlement state.

Cross-domain identity convergence is now the operating reality: Human users, service accounts and AI agents are increasingly moving through the same SaaS surfaces. That convergence makes lifecycle discipline and delegated-access governance the common language across IAM and NHI programmes, and it raises the cost of keeping those disciplines in separate teams.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: NHI Lifecycle Management Guide

What this signals

Browser context will become the missing layer in SaaS governance: Access policy alone cannot explain how identity is exercised inside modern SaaS and AI workflows. Teams need browser-level context to see whether the session behaviour matches the intended access path, especially when OAuth grants and embedded AI features can extend trust across systems.

Identity blast radius is now the practical metric that matters: Once a single SaaS compromise can cascade across downstream customers, lifecycle controls and delegated-access review become containment tools, not just compliance steps. Security leaders should assume that the largest risk is no longer the first compromise but the spread that follows.

Over-broad delegated access is the common failure pattern: Whether the actor is a user, service account or AI agent, the problem is the same when permissions are granted more widely than runtime need. That is why remediation speed, grant scope and browser telemetry now sit at the centre of effective SaaS and AI security.

For practitioners

• Map browser-mediated access paths Identify where SaaS access is granted and exercised through browser sessions, OAuth grants and embedded app workflows, then classify those paths as governed identity surfaces.
• Inventory AI agents as NHIs Track agents separately from human users and traditional service accounts so that delegated permissions, runtime scope and offboarding are visible in the same control model.
• Shorten the gap between detection and revocation Build remediation workflows that can revoke risky grants, sessions and connected access quickly when a SaaS or AI workflow becomes suspicious.
• Use browser-level telemetry for access validation Correlate user behaviour, session activity and integration use to detect when legitimate credentials are being exercised outside normal business context.

Key takeaways

• SaaS and AI now share the same identity surface, so browser sessions, OAuth grants and embedded workflows have become the main control points.
• High-impact SaaS breaches in 2025 showed that trusted integrations can spread compromise across many connected organisations.
• Security teams need faster revocation, better session context and explicit governance for non-human actors if they want to reduce blast radius.

Key terms

• Browser Context: Browser context is the session and interaction data generated while users work in SaaS and AI tools. It helps security teams understand intent, automation, and misuse more accurately than configuration data alone, especially when identity, approvals, and workflows all happen in the browser.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.