Why browser security is increasingly essential for the enterprise [Q&A]

As enterprises embrace hybrid work, SaaS applications, and AI tools at unprecedented scale, one critical access point is being increasingly targeted by attackers: the browser.

To better understand the risks and what can be done to secure the browser, we spoke with Alon Levin, vice president of product management at Seraphic Security, and an expert in enterprise browser security.

BN: What changes in enterprise IT environments have made browser security a more urgent priority today than it was just a few years ago?

AL: A few years ago, corporate apps were mostly hosted on-premises, and user activity flowed through secure networks with managed devices. That’s no longer the case. Today, most work happens in the browser, including access to SaaS platforms, cloud-based collaboration tools, and web apps.

At the same time, hybrid and remote work have exploded. That means employees, contractors, and third parties are accessing corporate data from unmanaged devices on untrusted networks. As a result of all the work being done in the browser, it has essentially become the new enterprise perimeter. The problem is that it was never designed with enterprise-grade security in mind. Traditional tools like firewalls and VPNs simply weren’t built to see or control what’s happening inside the modern browser, making it largely defenseless. So, that’s the gap we need to solve.

BN: How have browser-based attacks evolved in recent years, and what emerging threats pose the greatest risk to organizations today?

AL: Browser-based threats have gotten far more sophisticated and diverse. For example, we’re seeing widespread use of malicious extensions that can hijack sessions or exfiltrate data, session hijacking via stolen cookies, which allows attackers to bypass authentication entirely, and drive-by downloads that can inject malware without any user interaction. Other threats like cross-site scripting (XSS) or man-in-the-browser attacks allow hackers to take over active web sessions entirely. And this is just a sampling. The threats are continuing to expand, with new and improved tactics appearing constantly.

What’s especially concerning is how these threats are moving faster than most organizations can patch or respond. Without visibility and security controls at the browser level, organizations are flying blind against a fast-moving and highly targeted threat landscape.

BN: How has the popularization of AI impacted the browser and how companies secure it?

AL: AI is introducing multiple major challenges for browser security. On one hand, attackers are using AI to create more convincing phishing pages, write polymorphic code, and automate reconnaissance to craft highly targeted attacks.

On the other hand, AI tools are also being introduced into the enterprise — often as browser-based productivity extensions or web apps. When employees use unsanctioned or unvetted AI tools in the browser, it opens up new risks like unauthorized data sharing and leakage of proprietary information into third-party systems.

We’re also seeing attackers leverage AI to dynamically manipulate browser sessions or evade detection. That’s why securing AI interactions inside the browser, not just on the network or endpoint, is becoming a critical part of the security stack.

BN: Are there any misconceptions security leaders have when it comes to securing the browser?

AL: Absolutely. Many security teams assume that if they have MFA, EDR, or a secure web gateway, they’re covered. But none of those tools provide visibility into what’s happening inside the browser tab where most attacks now occur.

There’s also a misconception that browser extensions are harmless or that they’re adequately controlled by browser marketplaces. That’s not the case. We’ve seen high-profile incidents where compromised or malicious extensions were downloaded by hundreds of thousands of users.

Another myth is that securing the browser means sacrificing usability or tunneling all web traffic through a proxy. That’s outdated thinking. For example, Seraphic works with any browser, allowing enterprises and employees to use the browser of their choice with full protection.

BN: Looking ahead, how do you see browser security evolving in the next three to five years, both in terms of attack techniques and the security models that will be needed to defend against them?

AL: Browser-based attacks will continue to grow in both volume and sophistication, especially as more business processes move to the browser and AI tools continue to gain adoption.

To keep up, security will need to move closer to the user and into the browser itself. As such, I believe we’ll see broader adoption of in-browser security layers that can enforce policy, detect and guard against malicious behavior in real time, and integrate with broader zero trust architectures.

Long term, we believe the enterprise browser will become a foundational component of the security stack — on a par with endpoint protection or identity management. Forward-thinking organizations are already heading in that direction.

Image credit: jpkirakun/depositphotos.com