Because they control the path into the network, not the actions inside the session. Once users are inside SaaS apps or AI tools, copying, prompting, downloading, and sharing can still happen unless controls are enforced in the browser or endpoint workflow. That is why browser-mediated policy is gaining traction.
Why perimeter controls break down once work moves into SaaS and AI tools
Legacy VPN and perimeter tooling were built to decide whether a user or device may enter a network, then largely trust what happens after entry. That model fits a routed private network far better than browser-based SaaS and AI usage, where the meaningful risk is inside the session: copying data, uploading files, pasting prompts, and downloading results. In those workflows, the control point has shifted from the tunnel to the transaction.
Hybrid campuses make that gap easier to see. Users may move between office, home, shared spaces, and managed or unmanaged devices, but the same browser can reach the same cloud apps from all of them. A VPN can authenticate the path, yet it cannot reliably inspect every browser action or SaaS interaction in a way that follows the user across those changing contexts. Browser-mediated policy is attractive because it can sit where the work actually happens.
The deeper issue is not simply connectivity, it is authority. Once a session is established, a user can often perform actions that are perfectly valid from the application’s point of view but still unsafe for the organisation’s data boundary. That is why modern control design increasingly distinguishes between network access and action control, especially for copy, share, upload, prompt, and export behaviour in browser-delivered workflows.
Why AI use exposes the limits of network-only trust
AI tools intensify the same architectural weakness because they encourage fast, conversational, high-volume interaction with content. The security question is no longer just “who reached the service?” but “what did they place into it, and what did they extract from it?” A VPN does not understand whether a prompt contains sensitive code, customer data, or regulated information, and it does not govern the downstream use of the AI output once it returns to the user.
That matters because AI use often spans normal browser sessions, sanctioned enterprise apps, and shadow workflows that look harmless at the network layer. If the control strategy assumes that network entry equals acceptable use, organisations miss exfiltration paths that occur entirely after authentication. Samsung ChatGPT leak 2023 is a good reminder that the risk sits in what users can place into AI systems, not only in whether they reached them.
AI also makes overreliance on perimeter trust more dangerous because the asset being handled is often information, not a single session. Data can be copied into a browser, transformed by the model, then redistributed immediately. If organisations want durable control, they need enforcement that follows the interaction rather than the network route.
What a browser-first control model adds that VPNs cannot
Browser-mediated policy can apply context-sensitive rules at the point of use: who may paste, which sites may receive content, whether downloads are allowed, what can be shared, and when higher-risk actions need step-up controls. That is materially different from simply checking whether a device reached a protected subnet. It also aligns better with SaaS access, where the browser is the control plane for the work itself.
For teams modernising remote access, the practical shift is to treat VPN as one access mechanism among several, not as the main policy engine. Remote Access Identity Guide is useful here because it ties remote access security to MFA, device posture, ZTNA, and dormant VPN reduction, which are the kinds of controls that reduce dependence on a single perimeter choke point.
The same browser-first thinking also helps explain why session theft and valid-credential abuse are so effective against legacy remote access. If the attacker can get into a trusted session, the perimeter has already done its job, and the remaining exposure is what the session can do. CitrixBleed 2 2025 and SonicWall SSL VPN account compromises 2025 both show how trust placed at the edge can be bypassed when credentials or session material are abused.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST Zero Trust (SP 800-207), NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Session-level trust and least privilege are central when VPN trust stops at network entry. |
| Recommendation — Apply zero trust principles to verify each session action rather than assuming network entry is sufficient. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Browser and AI actions should be limited to the minimum needed after authentication. |
| IA-5 — Authenticator Management | VPN and remote access exposure depends on credential and session trust at the entry point. | |
| Recommendation — Enforce least privilege on user actions inside SaaS and browser sessions. Rotate and protect remote access credentials and session secrets aggressively. | ||
| OWASP ASVS | V8 — Authorization | Action control inside web sessions maps to application authorization rather than network access. |
| Recommendation — Test that sensitive browser actions are authorized at the point of use. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Hybrid work needs access controls that follow the user’s activity across apps and devices. |
| Recommendation — Restrict and review access paths that remain usable after network login. | ||
Practitioner Guidance
What to prioritise: Start by identifying which data-moving actions happen in the browser after sign-in, because those are the controls a VPN will never see. Then decide which of those actions warrant inline policy, logging, or step-up approval.
What to verify: Verify that your control stack can distinguish network admission from session behaviour. If it cannot observe paste, upload, download, or share actions in SaaS and AI tools, it is not yet governing the real risk surface.
Decision rule: If the user’s risk exposure is mainly inside the app session, prioritise browser or endpoint-enforced controls over additional perimeter tightening. If the risk is mainly initial access, perimeter controls still matter, but they are only the first gate.
Practitioner takeaway: Legacy VPNs answer “may this traffic enter the network?”, while modern work requires “may this action happen inside the session?”. The organisations that get this right move policy enforcement closer to the browser and endpoint workflow, where SaaS and AI actually operate.
Related resources from NHI Mgmt Group
- Why do legacy IAM controls struggle with AI-driven environments?
- Why do legacy IAM controls struggle with autonomous AI systems?
- How should security teams secure agentic AI workloads without relying on legacy perimeter controls?
- Why do legacy AppSec controls struggle in AI-native engineering environments?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org