Topic starter
19/08/2026 4:45 pm
TL;DR: Omdia’s Browser Management and Security report, cited by Island, says 55% of 400 enterprise IT and cybersecurity professionals saw a successful attack or near-miss through employee browser use in the past 12 months, while 59% say browser-based AI use is the least visible attack vector. The pattern shows why browser-native controls are becoming a governance issue for IAM, data protection, and shadow AI oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “New Report: The Browser Is Now Enterprise Security's Biggest Blind Spot”.
Key questions
Q: What fails when browser security relies on VPNs and gateways alone?
A: Perimeter tools can see traffic, but they cannot reliably see what happens inside a live browser session, such as paste events, extension behaviour, or prompt submissions to AI tools.
Q: Why do browser-based AI workflows increase data leakage risk?
A: Because they encourage users to move sensitive text directly into external prompts, often outside traditional file controls.
Q: How do security teams know if browser integrity controls are working?
A: They should look for three signals: complete coverage of payment pages, low-noise integrity alerts, and a fast approval or revoke path when unexpected script changes appear.
Practitioner guidance
- Define browser session policy as a governance control Map which browser actions require policy enforcement, including copy-paste, downloads, uploads, extension use, and AI prompt submission.
- Classify and govern approved AI platforms Create a browser-visible allowlist for AI tools that may handle company data, and block unsanctioned platforms from receiving sensitive information.
- Review unmanaged device browser exposure Test whether current controls still apply when users browse from BYOD, contractors’ machines, or other unmanaged endpoints.
Bottom line: Browser-based work has turned the browser into a control plane, which exposes the limits of security tools that only inspect traffic at the edge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:45 pm
Browser security has become an identity governance problem, not just an endpoint problem. When the browser mediates SaaS, AI, and data access, the effective control point is the session, not the device perimeter. That means identity context, policy enforcement, and audit need to operate at the interaction layer. Practitioners should treat browser governance as part of access governance, not as a separate user-experience concern.
A question worth separating out:
Q: Should organisations treat browser session data as part of identity governance?
A: Yes. Browser session data can function like a reusable access token, especially when cookies, autofill data, and stored credentials are present. Governance should cover where that material lives, how long it survives, and which users or devices should never keep it locally.
👉 Read our full editorial: Browser-based AI risk is exposing the limits of perimeter security