Topic starter
11/06/2026 11:09 pm
TL;DR: Nearly half of employees now use generative AI tools, 77% paste data into prompts, and GenAI accounts for 32% of corporate-to-personal data movement, making the browser the dominant exfiltration channel in modern work, according to LayerX Security’s Browser Security Report 2025. The governance gap is that identity, data, and session controls still stop at the IdP while risk now accumulates inside the browser.
Editorial analysis by NHI Mgmt Group, based on content published by LayerX Security: “Why The Browser Has Become the Enterprise’s Most Overlooked Endpoint”.
Key questions
Q: How should security teams govern browser-based policy enforcement for identity and data risk?
A: Start by classifying which decisions belong at session time rather than at login, then assign ownership across identity, endpoint, data, and SOC teams.
Q: Why do browser sessions create exfiltration risk even when SSO and MFA are in place?
A: Because SSO and MFA protect entry, not everything that happens inside an authenticated browser session.
Q: What breaks when browser extensions are allowed broad access to cookies and tabs?
A: Browser extensions can act like unmanaged software dependencies with access to identity-bearing session data.
Practitioner guidance
- Treat the browser as a primary control plane Move visibility and policy enforcement into browser activity so prompts, copy/paste, uploads, and account context are monitored where exfiltration actually occurs.
- Extend session governance beyond the IdP Track active sessions for token reuse, account crossover, and unmanaged browser access instead of assuming MFA and SSO end the risk at authentication.
- Govern browser extensions as supply-chain software Inventory extensions continuously, score publisher trust, review update cadence, and restrict sideloading where extensions can access cookies or SaaS tabs.
Bottom line: The browser has become the place where identity, data movement, GenAI use, and extension risk converge outside traditional control boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:40 am
Browser-native governance is now an identity issue, not a UX issue. The browser has become the place where authenticated state is reused, mutated, and exploited after the IdP has already handed off responsibility. That means identity programmes that end at login are structurally incomplete. Practitioners should treat browser telemetry and session behaviour as part of the identity control surface, not a separate endpoint problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What happens when employees upload sensitive data into GenAI tools from the browser?
A: Sensitive information can leave the organisation in ways traditional perimeter controls do not reliably stop. Once users can paste, upload, or share material into external GenAI services, confidential data may be exposed outside approved governance. The safest response is to apply browser-level restrictions and masking controls before information reaches the tool.
👉 Read our full editorial: Browser security is now the hidden control plane for identity risk
This post was modified 1 day ago by NHI Mgmt Group