Notifications
Clear all
Topic starter
10/06/2026 11:47 pm
TL;DR: CSPM and CNAPP can validate cloud configuration, but they cannot see browser-session abuse that happens after legitimate login, leaving a blind spot between the IdP and the final API call, according to Push Security. That missing middle means cloud and identity teams must treat the live browser session as part of the control plane, not just the infrastructure underneath it.
NHIMG editorial — based on content published by Push Security: one of the key questions about why browser visibility matters alongside CSPM and CNAPP
Questions worth separating out
Q: How should security teams handle browser sessions in cloud access governance?
A: Security teams should treat the browser session as part of the access boundary, not just a delivery mechanism.
Q: Why do CSPM and CNAPP miss some cloud attacks?
A: CSPM and CNAPP miss attacks that stay inside a legitimate session because they are built to assess configuration and posture, not in-session behaviour.
Q: What do security teams get wrong about browser-based cloud access?
A: Teams often assume that strong cloud configuration and identity controls are enough on their own.
Practitioner guidance
- Extend identity controls into the browser session Define the browser as a governed access boundary for cloud and SaaS use, then include session context in monitoring and investigation workflows.
- Inventory shadow SaaS and local account paths Track unmanaged applications, duplicate identities, and password-only access paths that bypass SSO or MFA.
- Add session evidence to response playbooks Require responders to capture click-by-click browser evidence when investigating suspected compromise.
What's in the full article
Push Security's full article covers the operational detail this post intentionally leaves for the source:
- How browser-native detection inspects page structure and user interaction in real time.
- Why session-level context helps responders distinguish legitimate use from abuse.
- What shadow SaaS discovery looks like when you need an inventory of unmanaged access paths.
- How browser telemetry supports containment decisions when cloud logs are incomplete.
👉 Read Push Security's analysis of the missing middle in cloud access security →
Browser visibility for cloud access: are your controls enough?
Explore further
12/06/2026 6:08 am
Browser-session visibility is now an identity governance problem, not just a detection problem. CSPM and CNAPP can validate whether cloud configurations are sound, but they cannot adjudicate what happens after a user has already entered a session. That means the real governance boundary has shifted from infrastructure posture to live interaction context. Practitioners should treat browser activity as part of access governance, not as an adjacent monitoring feed.
A few things that frame the scale:
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how narrow the operational trust margin still is.
A question worth separating out:
Q: How can organisations tell whether access is being used or abused?
A: They need session evidence, not just login records. Browser context shows what was rendered, what the user clicked, and whether the session behaved like a normal workflow or a manipulated one. That evidence helps investigators separate legitimate use from compromise and makes containment decisions more accurate.
👉 Read our full editorial: Browser-level cloud access closes the missing middle in IAM
