Topic starter
09/06/2026 11:18 pm
TL;DR: AI regulations in the US, EU, and UK are converging on obligations that many organisations cannot meet without browser visibility into AI tool use, according to Push Security. The hard part is not the regulation itself, but the fact that existing controls often miss what happens inside the browser.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Meet with Push Security at Black Hat Europe”.
Key questions
Q: How should organisations govern browser-accessible AI development tools?
A: They should classify them as identity-sensitive runtime services and apply the same scrutiny used for privileged admin tools.
Q: Why do traditional IAM controls miss browser-based AI risk?
A: Traditional IAM controls miss browser-based AI risk because they are strongest at authentication and access grant, not at observing in-session behaviour.
Practitioner guidance
- Define the browser as a governance boundary Map AI use cases to the browser session where prompts, uploads, and copy-paste actions occur, then decide which events must be observable for policy enforcement.
- Inventory AI tool usage at the session level Identify which approved, embedded, and unmanaged AI tools are reachable in browsers used by employees, contractors, and administrators.
- Align AI policy evidence to observable browser events Specify which browser events demonstrate acceptable use, data handling, and control effectiveness so compliance reviews do not depend on assumptions.
Bottom line: AI governance now depends on visibility at the browser session, where much of real-world tool use happens.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
10/06/2026 1:34 am
Browser visibility is becoming the missing control plane for AI governance. Authentication and SaaS policy were designed for access decisions, not for observing what users and tools do after the session begins. That gap becomes more obvious as AI use moves into the browser, where sensitive data can be entered, transformed, and exfiltrated without ever creating a clean identity event. Practitioners should treat browser telemetry as a governance signal, not an optional extra.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How can teams tell whether browser visibility is actually working?
A: Teams can tell browser visibility is working if it produces usable evidence about AI sessions, data handling, and policy enforcement decisions. The signal is not volume of telemetry, but whether security and compliance teams can reconstruct what happened in the browser and link it back to a responsible identity.
👉 Read our full editorial: Browser visibility is becoming central to AI governance and compliance
11/06/2026 12:39 am
Browser visibility is becoming the missing control plane for AI governance. Authentication and SaaS policy were designed for access decisions, not for observing what users and tools do after the session begins. That gap becomes more obvious as AI use moves into the browser, where sensitive data can be entered, transformed, and exfiltrated without ever creating a clean identity event. Practitioners should treat browser telemetry as a governance signal, not an optional extra.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How can teams tell whether browser visibility is actually working?
A: Teams can tell browser visibility is working if it produces usable evidence about AI sessions, data handling, and policy enforcement decisions. The signal is not volume of telemetry, but whether security and compliance teams can reconstruct what happened in the browser and link it back to a responsible identity.
👉 Read our full editorial: Browser visibility is becoming central to AI governance and compliance
12/06/2026 2:12 am
Browser visibility is becoming the enforcement layer for AI governance: The governance problem is no longer only whether a policy exists, but whether organisations can observe the actual AI interaction point. Browser-based use of AI tools creates a control gap between policy intent and user behaviour. The implication is that AI governance programmes must treat the browser as an operational boundary, not a secondary monitoring surface.
A question worth separating out:
Q: What is the difference between controlling AI apps and controlling AI use in the browser?
A: Controlling AI apps focuses on the service itself, such as access or tenant settings. Controlling AI use in the browser focuses on the user session, including prompts, copy-paste, uploads, extensions, and unmanaged access paths that may never appear as distinct application events.
👉 Read our full editorial: Browser visibility is becoming central to AI governance and compliance
This post was modified 8 hours ago by NHI Mgmt Group