Notifications
Clear all
Topic starter
09/06/2026 11:49 pm
TL;DR: Browser security has consolidated quickly, with three acquisitions in five months and 85% of organisations expecting to increase spend over the next 12 to 24 months, according to Push Security. The market signal is clear, but practitioners still have to separate platform convenience from the browser-layer identity controls needed to stop browser-based attacks.
NHIMG editorial — based on content published by Push Security: Why "good enough" isn't enough when it comes to browser security, and a best-of-breed approach is needed to tackle emerging threats
By the numbers:
- 85% of organizations expect to increase that spend over the next 12 to 24 months.
- 92% of organizations allow employees to use public GenAI applications.
Questions worth separating out
Q: How should security teams evaluate browser security for identity risk?
A: Security teams should evaluate browser security by asking whether it can see and stop identity abuse inside the session, not just block known malicious sites.
Q: Why do browser controls matter so much for IAM programmes?
A: Browser controls matter because the browser is where modern identity attacks are executed and where trust is created at login time.
Q: What do security teams get wrong about bundled browser security?
A: Teams often assume that a bundled browser feature is adequate if it reduces vendor count.
Practitioner guidance
- Re-evaluate browser controls as identity controls Map browser security requirements to the identity attacks you actually need to stop, including session hijack, OAuth consent abuse, and device code phishing.
- Test technique-based detection against live attacker behaviour Use realistic phishing kits and consent abuse scenarios rather than old URLs or known indicators.
- Tie browser telemetry into IAM and SaaS governance Route browser findings into identity workflows for access review, account takeover investigation, and risky SaaS suppression.
What's in the full article
Push Security's full analysis covers the operational detail this post intentionally leaves for the source:
- A breakdown of the browser attack techniques the vendor says it detects in live sessions, including AiTM phishing and ClickFix.
- Examples of how browser-layer telemetry surfaces password use, MFA gaps, risky extensions, and shadow SaaS that endpoint tools miss.
- Discussion of operational scale, false positives, and deployment considerations for teams evaluating browser security in production.
- The vendor's account of research output and detection velocity across new browser attack techniques.
👉 Read Push Security's analysis of browser security consolidation and identity risk →
Browser security consolidation: what it means for IAM teams?
Explore further
10/06/2026 2:19 am
Browser security consolidation is a governance problem before it is a procurement story. The market is moving quickly toward platform bundling, but identity risk does not consolidate at the same pace. If the browser is where credentials are entered, tokens are minted, and AI tools are invoked, then the buyer is really choosing how much session-level identity visibility they are willing to lose. Practitioners should treat consolidation as an architectural decision, not a line-item savings exercise.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How can organisations tell if browser security is actually working?
A: They should look for evidence that the control catches live attacks that other layers miss, such as AiTM phishing, ClickFix, risky OAuth consent, and unsanctioned AI usage. They should also measure whether the tool produces usable identity findings for remediation, not just high-volume alerts. A working control changes governance decisions.
👉 Read our full editorial: Browser security consolidation is testing identity governance models
