What should organisations do when attackers avoid the endpoint entirely?

Why This Matters for Security Teams

When attackers avoid the endpoint entirely, traditional EDR-centric thinking leaves a blind spot: the compromise happens in the browser session, identity layer, or cloud control plane rather than on a managed host. That shifts detection away from device telemetry and toward session behavior, token use, and unsafe actions taken in real time. NHI Management Group’s Ultimate Guide to NHIs — Why NHI Security Matters Now notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which shows how often identity, not malware, is the real entry point.

This is also why browser-native controls are gaining attention: the browser is now a control surface, not just a user interface. Current guidance suggests pairing inline session monitoring with identity-aware policy enforcement, especially when attackers can chain stolen credentials, cloud tokens, and web apps without ever dropping a detectable binary. The challenge is not simply blocking malware, but stopping malicious interaction before it becomes a cloud-side breach. In practice, many security teams encounter this only after a token is abused or a sensitive action has already completed, rather than through intentional browser-layer detection.

How It Works in Practice

The practical response is to move enforcement closer to the interaction point. Browser-native protection can observe page behavior, form submission patterns, clipboard abuse, suspicious redirects, and session anomalies that endpoint tools may never see. That makes it possible to stop risky actions while the session is active, rather than after the fact. For identity-heavy attacks, the browser often becomes the narrowest and most useful choke point.

Security teams typically combine three layers:

• Session-level detection that flags abnormal navigation, data entry, or exfiltration behavior.
• Inline response that blocks uploads, credential reuse, or access to sensitive apps when risk spikes.
• Identity-aware controls that validate the user, device posture, and action context before allowing the request.

This is consistent with the direction described in 52 NHI Breaches Analysis and in the OWASP NHI Top 10, where runtime abuse matters more than static perimeter assumptions. It also aligns with CISA cyber threat advisories, which consistently emphasize detection and response where attacker activity is observable. The operational goal is to make the browser, identity provider, and policy engine work together so unsafe behavior can be interrupted mid-session, not merely logged for later review. These controls tend to break down in unmanaged browser environments because the organisation cannot reliably inspect session context or enforce inline policy.

Common Variations and Edge Cases

Tighter browser-layer control often increases user friction and policy overhead, so organisations must balance response speed against workflow disruption. That tradeoff is real, especially for teams that support contractors, BYOD, or high-volume customer-facing portals.

Best practice is evolving, but current guidance suggests using different levels of enforcement based on data sensitivity and action risk. For example, a read-only portal may only need anomaly logging, while privileged admin consoles may require step-up checks, browser isolation, or immediate blocking when session behavior deviates. This is where browser protection works best alongside NHI governance, because stolen API keys, service tokens, and session cookies often move together.

Edge cases include legacy web apps that cannot support modern session instrumentation, remote support tools that behave like browsers but are not treated as such, and environments where users can switch devices mid-session. In those cases, organisations should avoid assuming that endpoint coverage alone equals visibility. Guidance from Anthropic’s AI-orchestrated cyber espionage campaign report and the MITRE ATLAS adversarial AI threat matrix reinforces the broader lesson: if the attacker is operating through legitimate interfaces, detection must understand the behavior, not just the device.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?