Every application moved into the browser. The management did not.

Mail, the CRM, the finance system and the ticket queue all open in the same window. The laptop underneath them is inventoried, encrypted, patched and watched by an agent. The window itself updates on a vendor's schedule, carries extensions the user chose, and holds the session cookies for every application the company pays for. Between those two facts sits a purchasing decision nobody wrote a line item for.

The client for every application you bought

Ask what software an employee operates for seven hours a day. The answer is one program with tabs in it. That program holds the session cookie issued after the multi-factor prompt, renders the login form, runs the extensions the user installed, and performs every upload. The managed layer sees less than the inventory suggests. The endpoint agent sees a process reading and writing files, the device manager sees a compliant machine, and the web proxy sees a hostname and a TLS handshake to a site nobody would think to block.

The joint phishing guidance from CISA, the NSA, the FBI and MS-ISAC sets out the sequence. A user follows a link to a site that mimics the company login portal, submits a username, a password and the six-digit code, and the actor replays all three at the real portal. Nothing in that sequence is a file and nothing in it leaves the browser window. The countermeasure those four agencies put ahead of the rest, FIDO or PKI based authentication, works because the credential is bound to the origin the browser is on, which is to say the fix only works from inside the browser.

The paste nobody watches, and the extension nobody counted

Eurostat reported that 20.0% of EU enterprises with ten or more employees used AI technologies in 2025, against 13.5% in 2024. Read the figure for what it measures. It counts adoption by the enterprise, the kind that produced a contract. It does not count the paralegal who pasted three clauses of a signed agreement into a chatbot on a Sunday, because there was no adoption and no contract.

The NCSC's post on the risk in large language models states the mechanical part. Queries are visible to the organisation providing the model, they are stored, and they will almost certainly be used in developing the service. The advice that follows is to take great care with what goes into a prompt. That is advice to a person, not a control, and it does not survive a deadline.

Each control already on the list misses this for its own reason. The mail gateway inspects messages, and a paste is not a message. The endpoint agent watches file operations, and a paste creates no file. The cloud access broker reaches the applications the company bought through the API those vendors publish, and no API exists for an account opened with a personal address. Three controls, three separate reasons, one gap.

The quieter half of this needs no paste at all. An extension that adds summarisation to mail, transcription to a meeting tab or drafting help to the CRM has to read the page in order to work, and reading the page means sending what is on it to whichever service the extension author chose. Nobody assessed that recipient, because nothing was bought and there is no procurement record to find.

Harden the endpoint, or replace the browser

Route one pushes harder on the machine you already manage. Nothing migrates, users notice nothing, and that is why it gets tried before the others. At the operating system layer, a corporate account and a personal account in the same browser profile are the same process talking to the same domain over the same certificate. Decrypting that traffic at a proxy moves the boundary slightly and brings its own bill. Pinned certificates break, the helpdesk inherits the breakage, and the decrypted stream still shows a POST to an allowed hostname, not the words in the box. The extension case is invisible from here as well, since the traffic is encrypted, the destination is a legitimate service, and the transfer happens inside a tab. Friction stays low because the control stays shallow.

Route two replaces the browser. Island, Talon (now part of Palo Alto Networks) and Chrome Enterprise all ask you to standardise on a particular browser and put the controls in the binary. Gartner's April 2025 press release predicts that 25% of organisations will deploy at least one secure enterprise browser technology by 2028 alongside the tools they already run, and puts deployment today below one in ten. The migration is the cost, and it is not a security project. It is saved passwords, the extension finance depends on, smart card and printer handling, the application that renders in one engine and not another, and a helpdesk queue that lasts as long as the rollout. The route also stops at the contractor's own laptop, since installing a browser on a machine you do not own needs a conversation you may not get. User friction runs high in the opening weeks and near zero afterwards, since the control sits inside the thing people open anyway.

Or control the browser already sitting there

Route three leaves the browser where it is and puts the policy inside it as an extension. The mechanical difference is what an extension can see. It runs in the page, so it sees the form submission before it is sent, the clipboard event as the text lands in the box, the file picker before the upload, and which account is signed into the tab. Those are the events the login portal itself sees, which is why the control can sit there.

The migration cost is a policy push through the device manager you already operate, so the effort route two spends on rollout, route three spends on policy design. Nothing changes on day one. Everything changes on the day somebody's paste is refused, and whether that lands as a ticket or a shrug depends on the message wording and on whether an override exists with a name on it.

The limits are worth stating. An extension covers the browsers you can reach with policy, so forcing the install and blocking removal is device management work whichever route you take. A user who installs a fourth browser sits outside the policy until you block that too. And an extension sees what the browser's extension platform permits. The move from Manifest V2 to Manifest V3 changed what an extension may do to network requests, and that was the browser maker's decision, not the security vendor's.

Questions worth asking before a pilot

The three routes are not equally wrong, and the estate decides between them. These questions separate them faster than a feature grid.

• Which browsers does the control cover, and how does anyone find out when it is removed, disabled or never installed.
• Which extensions are installed across the estate, what can each one read on the page, and who approved them.
• When a paste into an unapproved model is refused, what does the user see, who can override it, and is that override recorded against a name.
• Does the product tell a corporate account from a personal one in the same profile, by identity or by domain.
• Which controls run inside the browser and which need a proxy in the path, because that decides whether an unmanaged contractor laptop is in scope.

Three of those settle in a two week pilot with ten users. The rest need a written answer beforehand, because a pilot on clean managed laptops surfaces neither.

The product in this area

In secure workspace we carry DefensX, which takes route three. It installs as an extension on the browsers already deployed, stops credentials being typed into pages that imitate a corporate login, applies policy to what can go into an AI tool and surfaces the tools nobody approved. The secure workspace page sets out where that area ends and endpoint security begins.