Notifications
Clear all
Topic starter
12/06/2026 9:18 pm
TL;DR: Identity theft, credential abuse, and session hijacking inside the browser now drive the breaches that matter most, according to Push Security and cited threat intelligence from Verizon, CrowdStrike, Mandiant, Palo Alto Networks, and Omdia. Browser hardening still has value, but it does not address the dominant attack path.
NHIMG editorial — based on content published by Push Security: securing the browser vs. securing the organisation via the browser
By the numbers:
- Credential abuse and phishing combined accounted for 38% of all breaches.
- Cloud-conscious intrusions rose 37% in 2025.
- 49% of organizations suffered a successful browser-based attack in the last 12 months.
Questions worth separating out
Q: How should security teams protect users in the browser without relying only on endpoint hardening?
A: They should treat the browser as an identity control point and look for phishing, adversary-in-the-middle relays, session theft, and OAuth abuse in the session itself.
A: Because attackers can use legitimate login flows to inherit valid access, which is cheaper and more reliable than developing browser zero-days.
Q: What do security teams get wrong about browser security investments?
A: They often buy controls that defend the browser software, then expect those controls to stop identity theft inside the browser session.
Practitioner guidance
- Separate browser exploit protection from identity abuse detection Map current browser controls to the attack they actually address, then identify where phishing, AiTM, token theft, and OAuth consent abuse still pass through without meaningful visibility.
- Inventory browser-based identity exposure across managed and unmanaged devices Trace where users authenticate from BYOD, contractor endpoints, synced profiles, and secondary browsers so the programme covers the real session entry points rather than only corporate laptops.
- Correlate browser telemetry with identity events Join login context, token use, consent grants, and session anomalies so a successful authentication does not automatically count as a trusted session.
What's in the full article
Push Security's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side vendor architecture breakdowns for browser hardening, sandboxing, and identity-focused detection
- Specific threat intelligence references and campaign examples behind the browser-based breach pattern
- Operational arguments about deployment trade-offs, device coverage, and managed versus unmanaged endpoint visibility
- Product-level comparisons of what each approach detects during phishing, AiTM, and OAuth abuse events
👉 Read Push Security's analysis of browser-based identity attacks and breach risk →
Browser identity attacks: what security teams are missing?
Explore further
12/06/2026 11:16 pm
Browser security is now an identity governance problem, not only an endpoint problem. The article is right to separate browser exploitation from browser-based identity abuse. Once the browser becomes the primary authentication surface, the governance question shifts from 'Can the browser be compromised?' to 'Can identity misuse be seen in the session?' That is a different control philosophy, and it affects IAM, PAM, and NHI oversight alike. Practitioners should treat browser telemetry as part of identity control coverage, not as a separate product category.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who should own browser-based identity risk in an enterprise?
A: Ownership should sit across IAM, security operations, and endpoint teams, because the risk spans authentication, session handling, and device posture. If browser-based attacks are only treated as endpoint issues, identity abuse will be missed. If they are only treated as IAM issues, device and browser context will be ignored. Shared ownership is the only workable model.
👉 Read our full editorial: Browser security is really identity security in disguise
