Jan 13 2026

When Identity Meets the Browser: How CrowdStrike Is Closing a Critical Enterprise Security Blind Spot

Category: Identity Theft,Information Security,Security Incident,Web Search Engine,Web Security — disc7 @ 12:42 pm

Summary: to Address a Security Blind Spot

CrowdStrike recently announced an agreement to acquire Seraphic Security, a browser-centric security company, in a deal valued at roughly $420 million. This move, coming shortly after CrowdStrike’s acquisition of identity authorization firm SGNL, highlights a strategic effort to eliminate one of the most persistent gaps in enterprise cybersecurity: visibility and control inside the browser — where modern work actually happens.

Why Identity and Browser Security Converge

Modern attackers don’t respect traditional boundaries between systems — they exploit weaknesses wherever they find them, often inside authenticated sessions in browsers. Identity security tells you who should have access, while browser security shows what they’re actually doing once authenticated.

CrowdStrike’s CEO, George Kurtz, emphasized that attackers increasingly bypass malware installation entirely by hijacking sessions or exploiting credentials. Once an attacker has valid access, static authentication — like a single login check — quickly becomes ineffective. This means security teams need continuous evaluation of both identity behavior and browser activity to detect anomalies in real time.

In essence, identity and browser security can’t be siloed anymore: to stop modern attacks, security systems must treat access and usage as joined data streams, continuously monitoring both who is logged in and what the session is doing.

AI Raises the Stakes — and the Signal Value

The rise of AI doesn’t create new vulnerabilities per se, but it amplifies existing blind spots and creates new patterns of activity that traditional tools can easily miss. AI tools — from generative assistants to autonomous agents — are heavily used through browsers or browser-like applications. Without visibility at that layer, AI interactions can bypass controls, leak sensitive data, or facilitate automated attacks without triggering legacy endpoint defenses.

Instead of trying to ban AI tools — a losing battle — CrowdStrike aims to observe and control AI usage within the browser itself. In this context, AI usage becomes a high-value signal that acts as a proxy for risky behavior: what data is being queried, where it’s being sent, and whether it aligns with policy. This greatly enhances threat detection and risk scoring when combined with identity and endpoint telemetry.

The Bigger Pattern

Taken together, the Seraphic and SGNL acquisitions reflect a broader architectural shift at CrowdStrike: expanding telemetry and intelligence not just on endpoints but across identity systems and browser sessions. By aggregating these signals, the Falcon platform can trace entire attack chains — from initial access through credential use, in-session behavior, and data exfiltration — rather than reacting piecemeal to isolated alerts.

This pattern mirrors the reality that attack surfaces are fluid and exist wherever users interact with systems, whether on a laptop endpoint or inside an authenticated browser session. The goal is not just prevention, but continuous understanding and control of risk across a human or machine’s entire digital journey.

Addressing an Enterprise Security Blind Spot

The browser is arguably the new front door of enterprise IT: it’s where SaaS apps live, where data flows, and — increasingly — where AI tools operate. Because traditional security technologies were built around endpoints and network edges, developers often overlooked the runtime behavior of browsers — until now. CrowdStrike’s acquisition of Seraphic directly addresses this blind spot by embedding security inside the browser environment itself.

This approach extends beyond snippet-based URL filtering or restricting corporate browsers: it provides runtime visibility and policy enforcement in any browser across managed and unmanaged devices. By correlating this with identity and endpoint data, security teams gain unprecedented context for detecting session-based threats like hijacks, credential abuse, or misuse of AI tools.

Source: to Address a Security Blind Spot

My Opinion

This strategic push makes a lot of sense. For too long, security architectures treated the browser as a perimeter, rather than as a core execution environment where work and risk converge. As enterprises embrace SaaS, remote work, and AI-driven workflows, attackers have naturally gravitated to these unmonitored entry points. CrowdStrike’s focus on continuous identity evaluation plus in-session browser telemetry is a pragmatic evolution of zero-trust principles — not just guarding entry points, but consistently watching how access is used. Combining identity, endpoint, and browser signals moves defenders closer to true context-aware security, where decisions adapt in real time based on actual behavior, not just static policies.

However, executing this effectively at scale — across diverse browser types, BYOD environments, and AI applications — will be complex. The industry will be watching closely to see whether this translates into tangible reductions in breaches or just a marketing narrative about data correlation. But as attackers continue to blur boundaries between identity abuse and session exploitation, this direction seems not only logical but necessary.

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | AIMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

At DISC InfoSec, we help organizations navigate this landscape by aligning AI risk management, governance, security, and compliance into a single, practical roadmap. Whether you are experimenting with AI or deploying it at scale, we help you choose and operationalize the right frameworks to reduce risk and build trust. Learn more at DISC InfoSec.

Tags: Blind Spot, browser security, Critical Enterprise Security

Mar 06 2023

Browser Security report reveals major online security threats

Category: Information Security,Web Security — DISC @ 12:27 pm
browser safety report 2022

LayerX has published its annual browser security report in which the company highlights the most prominent browser security risks of 2022. The report includes predictions and recommendations for 2023 as well.

The report focuses on Enterprise environments, but several of its key takeaways apply to small business and home environments as well. The browser security threats of 2022 make up the largest part of the document, but users find predictions, recommendations and an interesting monthly overview of major security events in the report as well.

The nine major threats that LayerX identified in 2022 were the following ones:

  • Phishing attacks via high reputation domains.
  • Malware distribution via file sharing systems.
  • Data leakage through personal browser profiles.
  • Outdated browsers.
  • Vulnerable passwords.
  • Unmanaged devices.
  • High-risk extensions.
  • Shadow SaaS.
  • MFA bypass with AiTM attacks.

Some of these are quite clear, others may require explanation. For phishing attacks, the researchers discovered that threat actors are hosting phishing URLs on legitimate SaaS platforms at an alarming rate. The rate of phishing attacks that use these legitimate platforms has increased by 1100% when compared to 2021, according to a Palo Alto Networks study.

LayerX conducted tests on how well browsers and network security tools protected against 1-day phishing sites. According to the test, the best performing browser had a catch rate of just 36%. Network security software blocked 48% of threats.

Similarly, malware is distributed via sanctioned services such as Google Drive and Microsoft OneDrive, to overcome blocks that may be in place for lesser known services and sites.

An analysis of data leakage in browsers concluded that 29% of users connected work browsers to personal profiles, and that 5.8% of identities were exposed in data breaches.

Outdated browsers are another threat to security, according to LayerX’s report. Ana analysis of 500 Chrome browsers revealed that a good number was either critically outdated or vulnerable to 1-day attacks.

Weak passwords and the reuse of passwords continue to be major issues. According to LayerX’s report, 29% of users use weak or medium strength passwords, and 11% of users reuse passwords regularly. The company noticed that 29% browser profiles were personal and set to sync.

Web browser extensions are another attack vector, as they “can grant excessive permissions once installed”. A recent Incogni study found that almost half of the analysed browser extensions posted either a high security or privacy risk.

The report includes an overview of browser security highlights of the year 2022. It is an interesting account that lists major security events in 2022. Some of these involved attacks, like the January 2022 video player attack that stole credit card information from over a hundred sites. Others highlight security advances, like the passwordless logins announcement by major tech companies in May, or the end of Internet Explorer in June.

The report ends with four predictions and recommendations. Predictions include that browsers will become “the main attack surface”, that attacks will “be increasingly SaaS-based and less file-based”, and that malicious web pages “will become more sophisticated”.

Closing Words

The report offers insights on the browser threat landscape of 2022, and how threats will evolve in 2023 and beyond. While most of it is aimed at Enterprise and large business environments, it may still be of interest to home users and small businesses alike.

The recommendations focus on SaaS and Enterprise-grade protections, but all users may use the listed threats to improve security. For example, outdated browsers may be updated more frequently, and weak or reused passwords may be replaced with unique strong passwords.

The report is available for download here, but a short form needs to be filled out before the download link is made available.

Source:

https://www.ghacks.net/2023/03/05/browser-security-report-reveals-major-online-security-threats/

Previous posts on Web Security

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Web App Security

Tags: browser security

Sep 16 2022

Browser-in-the-browser attacks

Category: Web Security — DISC @ 8:30 am

Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

Researchers at threat intelligence company Group-IB just wrote an intriguing real-life story about an annoyingly simple but surprisingly effective phishing trick known as BitB, short for browser-in-the-browser.

You’ve probably heard of several types of X-in-the-Y attack before, notably MitM and MitB, short for manipulator-in-the-middle and manipulator-in-the-browser.

In a MitM attack, the attackers who want to trick you position themselves somewhere “in the middle” of the network, between your computer and the server you’re trying to reach.

(They might not literally be in the middle, either geographically or hop-wise, but MitM attackers are somewhere along the route, not right at either end.)

The idea is that instead of having to break into your computer, or into the server at the other end, they lure you into connecting to them instead (or deliberately manipulate your network path, which you can’t easily control once your packets exit from your own router), and then they pretend to be the other end – a malevolent proxy, if you like.

They pass your packets on to the official destination, snooping on them and perhaps fiddling with them on the way, then receive the official replies, which they can snoop on and tweak for a second time, and pass them back to you as though you’d connected end-to-end just as you expected.

If you’re not using end-to-end encryption such as HTTPS in order to protect both the confidentiality (no snooping!) and integrity (no tampering!) of the traffic, you are unlikely to notice, or even to be able to detect, that someone else has been steaming open your digital letters in transit, and then sealing them again up afterwards.

more details: Serious Security: Browser-in-the-browser attacks – watch out for windows that aren’t!

Web Security for Developers: Real Threats, Practical Defense

Browser Security A Complete Guide

Tags: browser security, web security