Topic starter
02/08/2026 11:30 am
TL;DR: Traditional VPN, VDI, and device-centric controls no longer fit a workforce of employees, contractors, and partners across managed and unmanaged devices, according to Island. The governance shift is from granting access once to continuously controlling what users can do with data after access is granted.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “Island & Cisco Secure Access: Zero Trust Everywhere”.
Key questions
Q: How should security teams implement zero trust for BYOD and third-party access?
A: Security teams should separate authentication from device ownership and design controls for unmanaged endpoints explicitly.
Q: Why do VPNs and VDI fall short for third-party access?
A: VPNs and VDI focus on entry, while third-party work now depends on what happens inside the session.
Q: What breaks when access controls do not extend beyond authentication?
A: What breaks is the assumption that a verified user is still safe once inside the application.
Practitioner guidance
- Define browser-session data controls Create policy for copy, paste, download, upload, and share actions inside sensitive web applications so enforcement follows the session.
- Treat unmanaged devices as conditional access cases Require real-time posture checks and step-up controls for BYOD and third-party access instead of assuming device enrollment is available.
- Align zero trust policy with browser usage Map which applications need browser-native restrictions, especially where sensitive data and AI tools are used directly in web sessions.
Bottom line: Browser-native zero trust shifts security from access approval to continuous control of user actions inside the session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:46 pm
Browser control is becoming an identity control. When work moves into the browser, the real governance boundary shifts from the network edge to the session itself. That is why access verification alone is no longer enough for modern work patterns. For IAM and zero trust programmes, the browser now functions as a policy enforcement point for human users, contractors, and partners alike.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations prioritise browser-native controls over endpoint tools?
A: When the primary risk is inside browser execution, not the device OS or network path. If the threat involves tab capture, request interception, or session-level data theft, browser-native controls give better visibility than endpoint tools that cannot inspect those actions in context.
👉 Read our full editorial: Zero trust browser controls reshape secure access beyond the VPN