Topic starter
26/08/2026 11:51 am
TL;DR: Browser-based admin work is now a privileged access problem, not just a usability issue, because many critical actions happen in web consoles and portals without the monitoring, recording, or granular control PAM teams expect, according to Wallix and a 2025 industry survey. The security model still assumes high-risk access lives in SSH and RDP sessions, but the browser has become a governed workspace that most programmes have not instrumented.
Editorial analysis by NHI Mgmt Group, based on content published by Wallix: “Browser-Based Privileged Access: The Web Session Security Gap Most PAM Programs Miss.”.
By the numbers:
- 95% of organisations experienced a browser-originated attack in the past year, according to Wallix.
- 94% reported phishing incidents, according to Wallix.
- 64% of encrypted web traffic goes uninspected in most organisations, according to Wallix.
Key questions
Q: Where does PAM fail when administrators work through browsers?
A: PAM fails when it assumes privileged work only happens in SSH, RDP, or database sessions.
Q: Why do browser-based admin sessions increase operational risk?
A: Because the browser can carry privileged action paths, session tokens, and sensitive application state in a way older access models do not isolate.
Q: What are the signs that web-based privileged access is under-governed?
A: Common signs include admin portals with no session recording, browser access that bypasses endpoint controls, and no restriction on clipboard or file transfer during high-risk work.
Practitioner guidance
- Classify browser administration as privileged access Inventory cloud consoles, SaaS admin portals, ERP interfaces, and industrial web dashboards as privileged channels and bring them under PAM policy.
- Extend session recording to web sessions Capture browser-based privileged actions with video, metadata, and action logs so review evidence exists after the session ends.
- Apply granular controls inside web applications Restrict clipboard, file transfer, printing, and other sensitive operations by application and by role, not only by login identity.
Bottom line: Browser-based administration creates a privileged access gap when PAM programmes stop at SSH and RDP.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Browser-based privileged access is now a PAM governance problem, not a web-security edge case: The control model that grew up around SSH and RDP no longer captures where administrators actually act. Cloud consoles, ERP portals, identity dashboards, and industrial web interfaces all execute privileged actions, so the browser has become part of the privileged access plane. The implication is that PAM scope must be defined by privilege, not by protocol.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern browser-based privileged access across cloud and SaaS tools?
A: Treat web-based administration as privileged access, define which applications and actions are in scope, and apply the same review and control expectations used for other elevated sessions. Governance should follow the work, not the protocol used to reach it.
👉 Read our full editorial: Browser-based privileged access leaves a PAM governance gap