Topic starter
13/10/2026 1:21 pm
TL;DR: The browser is the policy enforcement point for modern identity attacks because it can combine IdP, endpoint, SASE, and threat-intel signals to harden authentication and govern sessions on unmanaged and contractor devices, according to Seraphic. That shifts the control plane from login only to continuous, per-app session decisions, where token theft, risky OAuth grants, and data exfiltration can be contained after auth.
Editorial analysis by NHI Mgmt Group, based on content published by Seraphic: “Identity, Enforced at the Browser: How Seraphic Turns Signals into Real-Time Protection”.
Key questions
Q: How should security teams govern browser-based access to sensitive applications?
A: Treat browser-based access as part of the privileged access surface when it reaches cloud consoles, admin portals, or operational systems.
Q: Why do unmanaged devices create an identity governance problem?
A: Because identity control depends on knowing both who is accessing and from what trusted endpoint.
Q: What are the best controls for reducing identity risk after login?
A: Use controls that can act on the active session, not just on sign-in.
Practitioner guidance
- Map browser-session controls to your identity risk events Define which IdP, EDR, and threat-intel signals should trigger step-up auth, selective logout, read-only mode, or content masking for each SaaS app.
- Prioritise unmanaged-device access paths Inventory contractor and BYOD access to SaaS and determine which sessions bypass endpoint controls but still carry sensitive identity risk.
- Tighten pre-auth protections on login pages Block look-alike IdP domains, risky extensions, and unknown-domain auto-fill so credentials are not exposed before authentication completes.
Bottom line: The main issue is not initial authentication alone, but what an active browser session can still do when risk changes after sign-in.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Browser-based identity governance is becoming a session problem, not a login problem. The article describes attacks that begin before authentication and continue long after it, which means the governance boundary has moved. Traditional IdP-centric thinking assumes the hard part is proving identity once, but the practical risk now sits in what the authenticated session can still do. Practitioners should treat post-auth control as part of identity governance, not as an adjacent security concern.
A question worth separating out:
Q: What happens when identity controls stop at authentication?
A: The session can keep working after the original risk changes, which leaves token theft, risky OAuth grants, and data exfiltration paths open. That is why identity governance has to continue after login if the organisation wants to contain abuse without blocking every user action.
👉 Read our full editorial: Browser-based identity enforcement for unmanaged sessions and BYOD