Notifications
Clear all
Topic starter
02/08/2026 12:29 pm
TL;DR: Compromised credentials remain effective because MFA, browser controls, and user education still leave gaps in phishing, session theft, extension abuse, and third-party access, according to Island. The practical lesson is that identity security has to move closer to the browser and session, where credential misuse actually occurs.
NHIMG editorial — based on content published by Island: Updated: How the Enterprise Browser Neutralizes the Risks of Compromised Credentials
By the numbers:
- Researchers recently found that 25% of the malware they collected in 2024 was designed to steal user credentials.
- In 2024, 67% of healthcare organizations were hit by ransomware, resulting in disruptions in patient care and recovery payouts averaging $2.57 million.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: How should security teams reduce the risk of compromised credentials in browser-based access?
A: Security teams should combine browser restrictions, step-up authentication, and mediated credential handling.
Q: Why do compromised credentials often bypass MFA controls?
A: Because many attacks steal the artifact issued after MFA, not the password itself.
Q: What do teams get wrong about browser controls and identity governance?
A: Teams often assume that strong login controls are enough, but the risk usually appears after authentication, inside the session.
Practitioner guidance
- Constrain where credentials can be entered Block unmanaged browsers from sensitive applications and enforce browser-controlled access paths for privileged workflows and SaaS apps that hold business-critical data.
- Mediate shared and privileged credentials Replace password sharing with zero-knowledge privileged access patterns so users never handle raw secrets and shared accounts are not exposed during normal work.
- Recheck identity at session risk changes Use step-up authentication when users move into higher-risk application areas, change device posture, or access data that materially increases exposure.
What's in the full article
Island's full post covers the operational detail this post intentionally leaves for the source:
- Browser enforcement patterns for blocking unmanaged access to high-risk SaaS applications
- Zero-knowledge privileged access workflows for shared accounts and delegated admin use cases
- Inline password transformation and credential injection mechanics across legacy and modern web apps
- Malicious extension detection logic and dynamic risk scoring for browser governance
👉 Read Island's analysis of how browser controls reduce compromised credential risk →
Compromised credentials in the browser layer: are your controls enough?
Explore further
02/08/2026 1:27 pm
Browser-layer governance is now part of identity security, not a usability concern. The article correctly shows that compromise often happens after authentication, when credentials are stored, replayed, or exfiltrated through the browser. That means IAM teams cannot treat browser behaviour as outside the identity stack. The practical conclusion is that identity policy must follow the session into the browser.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, according to The State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
A question worth separating out:
Q: Who is accountable when third-party credentials are used to reach enterprise systems?
A: Accountability sits with both the organisation granting access and the party operating it. Identity governance must cover onboarding, scope, monitoring, and offboarding for every delegated account, especially support engineers and contractors. If those lifecycles are unclear, the enterprise has no reliable control over blast radius.
👉 Read our full editorial: Enterprise browsers and compromised credentials: what changes for IAM
