Should organisations prioritise browser security for unmanaged devices and shadow SaaS access?

Why This Matters for Security Teams

Yes, browser security should be treated as a priority for unmanaged devices and shadow SaaS because those paths often bypass the controls that security teams rely on for endpoint trust, SaaS discovery, and conditional access. When users reach business apps through personal laptops, contractor devices, or ad hoc browser sessions, the browser becomes the enforcement point for session control, data protection, and real-time monitoring.

This matters even more where SaaS is being used outside sanctioned procurement. shadow access commonly hides in personal accounts, forwarded links, and browser-based workflows that never touch a managed endpoint. NHI exposure can also expand quickly when those sessions create or reuse API keys, OAuth grants, or automation tokens. NHIMG research shows that only 5.7% of organisations have full visibility into service accounts, which is a useful warning sign for how weak identity visibility can become once access moves beyond managed devices in the browser. See Ultimate Guide to NHIs and the NIST Cybersecurity Framework 2.0 for the broader visibility and protection model.

In practice, many security teams discover unmanaged browser access only after a sensitive SaaS tenant, token, or shared workspace has already been abused.

How It Works in Practice

Browser security works best when it is treated as a control plane for sessions, not just a web filtering layer. For unmanaged devices, the browser can enforce conditional access, isolate sensitive tabs, restrict copy and paste, control downloads, and record risky activity without requiring a full endpoint agent. For shadow SaaS, it can help identify sanctioned and unsanctioned app use, flag suspicious logins, and apply step-up controls when the context changes.

That approach aligns with current guidance in OWASP Non-Human Identity Top 10 and Top 10 NHI Issues, because browser-mediated access often leads to new secrets, delegated OAuth grants, and embedded automation. In NHI terms, the browser is where human intent can turn into machine privilege. Security teams should therefore inspect session creation, token issuance, and privileged actions together, not as separate workflows.

• Use browser-based controls to enforce policy on BYOD, contractors, and devices that cannot run EDR.
• Pair discovery with SaaS governance so unknown apps are not simply blocked without review.
• Apply just-in-time access and short session TTLs where high-risk data or admin functions are involved.
• Monitor for OAuth consents, API token creation, and browser-to-SaaS handoffs that may create new NHIs.

This guidance tends to break down when users pivot to unmanaged native clients, mobile apps, or out-of-band token exchange because the browser is no longer the sole enforcement point.

Common Variations and Edge Cases

Tighter browser control often increases user friction and support overhead, so organisations have to balance security against workflow disruption, especially in mixed-device environments. That tradeoff is real in environments with heavy contractor use, regulated collaboration, or legacy SaaS that still depends on browser plug-ins and old authentication flows.

Best practice is evolving for shadow SaaS, because there is no universal standard yet for how aggressively to block unsanctioned apps versus broker them into managed access. Some teams focus first on visibility and session logging, then apply policy only to high-risk categories such as file sharing, AI tools, and admin consoles. Others extend the browser into a broader Zero Trust model, using device posture, identity assurance, and request context together. The State of Non-Human Identity Security and 52 NHI Breaches Analysis both underline how quickly identity sprawl becomes an incident when controls are fragmented.

Browser security is most effective for unmanaged-device access when organisations can consistently identify the app, the user, and the session. It becomes less reliable in environments where shadow IT is driven by personal accounts, consumer browsers, or federated logins that the organisation cannot broker.

Related resources from NHI Mgmt Group

• Should organisations prioritise discovery or access restriction first for shadow AI?
• Should organisations prioritise token controls before expanding SaaS access?
• Should organisations prioritise remediation or discovery first in SaaS security?
• How should security teams govern browser extensions that access SaaS data?