Notifications
Clear all
Topic starter
04/07/2026 10:15 pm
TL;DR: Browser-based access has become the dominant path to cloud consoles, portals, and sensitive applications, while patchwork controls create blind spots and audit gaps, according to Wallix. The security issue is no longer just endpoint isolation; it is whether privileged access governance can extend to every session that now happens in the browser.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should security teams govern browser-based access to sensitive applications?
A: Treat browser-based access as part of the privileged access surface when it reaches cloud consoles, admin portals, or operational systems.
Q: Why do browsers complicate privileged access management?
A: Browsers complicate PAM because they mix ordinary user activity with high-risk administrative actions in the same interface.
Q: What breaks when browser sessions are not isolated or traced?
A: What breaks is the ability to contain malicious web content and reconstruct administrative behaviour with confidence.
Practitioner guidance
- Extend PAM controls to browser sessions Classify cloud consoles, SaaS admin portals, and industrial web interfaces as privileged access surfaces and bring them into the same monitoring, recording, and approval model used for traditional admin sessions.
- Unify session evidence across web access paths Ensure authentication logs, session traces, and user activity records are correlated so investigators can reconstruct browser-mediated administrative actions without stitching together separate tools.
- Prioritise isolation for high-risk web pathways Apply Remote Browser Isolation to web access routes that terminate in sensitive applications or administrative functions, especially where users access partner portals or cloud management planes.
What's in the full announcement
Wallix's full analysis covers the operational detail this post intentionally leaves for the source:
- How WALLIX Web Session Manager fits into the WALLIX One platform architecture for browser governance
- The specific operational scenarios for cloud consoles, partner portals, and industrial interfaces
- The analyst and customer references Wallix uses to frame adoption and market validation
- The compliance mapping Wallix highlights for NIS2, DORA, and IEC 62443
👉 Read Wallix's analysis of browser-based access governance and PAM →
Browser-based access governance: what it means for IAM teams?
Explore further
04/07/2026 10:18 pm
Browser access has become the new privileged access surface. Once business applications, cloud consoles, and operational portals moved into the browser, the old split between end-user web activity and privileged administration stopped being reliable. The consequence is structural, not cosmetic: governance teams now need to treat browser-mediated sessions as part of access control, session supervision, and audit evidence. That is the control plane shift practitioners need to recognise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams decide whether browser isolation is enough?
A: Browser isolation is not enough if the organisation still lacks session-level oversight, access policy alignment, or audit reconstruction. It reduces one class of endpoint risk, but privileged access governance still depends on visibility, control, and evidence. The right test is whether the session can be governed end to end, not just rendered safely.
👉 Read our full editorial: Browser-based access governance is becoming a PAM problem
