How should security teams extend Zero Trust controls into the browser for managed and unmanaged devices?

Why This Matters for Security Teams

Extending zero trust into the browser matters because the browser is often where identity, policy, and application access converge first. For managed devices, teams can lean on endpoint posture and device certificates. For unmanaged devices, that trust signal is weaker, so the browser must become the enforcement point that evaluates context before enterprise resources are exposed. NIST’s NIST SP 800-207 Zero Trust Architecture frames this as continuous verification, not one-time trust.

The practical challenge is that browser access is not a single control. It is a chain of decisions about who the user is, whether the device is acceptable, what data the session can reach, and whether the session should be isolated or brokered. That is why browser-based controls are increasingly part of NHI and identity governance, especially as unmanaged endpoints and third-party access expand. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks notes that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, which is a strong signal that identity enforcement cannot stop at the network edge.

In practice, many security teams discover their weakest access paths only after browser sessions have already become the preferred route into SaaS apps, admin consoles, and internal portals.

How It Works in Practice

Browser Zero Trust works best when the browser is treated as a policy enforcement layer rather than a passive window to the internet. On managed devices, the browser can inherit device trust from EDR, MDM, certificates, and posture checks. On unmanaged devices, the browser usually needs compensating controls such as session isolation, ephemeral access, strong phishing-resistant authentication, download restrictions, and data-loss controls. The goal is to make access decisions at the moment of use, not at login alone.

A practical implementation usually combines identity, posture, and session policy:

• Authenticate the user with phishing-resistant MFA and bind the session to the browser context.
• Check device trust signals for managed endpoints, or downgrade trust for unmanaged endpoints.
• Apply conditional access so privileged apps require stronger assurance than low-risk apps.
• Broker sensitive sessions through a controlled browser or remote browser isolation when device trust is unknown.
• Continuously re-evaluate access during the session, especially for risky actions like export, upload, or admin changes.

This model aligns with NIST Cybersecurity Framework 2.0 because it emphasizes governance, protection, and continuous risk management across access paths. It also fits NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, which highlights that identity controls only work when they follow the full access lifecycle, including issuance, use, rotation, and revocation. For browser-mediated access, that means the session itself should be short-lived, tightly scoped, and easy to terminate if risk changes.

These controls tend to break down when legacy web apps require broad session cookies or when unmanaged devices must access privileged administrative tools that were never designed for contextual access decisions.

Common Variations and Edge Cases

Tighter browser control often increases friction for users and support teams, so organisations must balance security depth against usability and rollout complexity. Current guidance suggests there is no universal standard for browser-based Zero Trust on unmanaged devices, which means implementation choices depend on app sensitivity, user population, and regulatory pressure.

Managed and unmanaged endpoints usually need different policy bands. Managed devices can often be allowed direct access with full posture validation. Unmanaged devices are better treated as higher-risk, with brokered sessions, reduced data movement, and stronger logging. For contractors, partners, and emergency access, teams should define exceptions in advance rather than creating ad hoc approvals during incidents. This is especially important where browser access is the only practical path to a SaaS console or admin portal.

NHIMG’s Top 10 NHI Issues is useful here because browser controls often expose the same failure patterns seen in NHI governance: over-privilege, weak lifecycle control, and poor visibility. For identity-intensive access models, Guide to SPIFFE and SPIRE is also relevant as a reference point for workload identity thinking, even though browser sessions are user-centric rather than workload-centric. The architectural lesson is the same: trust should be asserted and revalidated, not assumed.

Browser Zero Trust becomes brittle when unmanaged-device access is granted broad clipboard, download, and admin privileges without session-level isolation or strong conditional policy.

Related resources from NHI Mgmt Group

• How should security teams enforce zero trust across managed and unmanaged devices?
• How should security teams extend Zero Trust to unmanaged devices and shadow IT without slowing employees down?
• How should security teams extend Zero Trust across hybrid and offline Microsoft environments without weakening phishing resistance or MFA resilience?
• How should security teams extend device trust controls to BYOD and third-party devices without relying only on MDM?