Zero Trust in a SaaS and AI World

The Browser Is the Enterprise Perimeter

For years we said the perimeter was dead. We moved to cloud, adopted SaaS, embraced remote work, and redesigned identity around Zero Trust. But if you look at real breaches over the past few years, something becomes obvious.

Most modern compromises do not begin with network exploitation.
They begin in the browser.

An engineer pastes proprietary code into a generative AI tool.
A finance user approves a malicious OAuth application.
An attacker replays a stolen SaaS session token and bypasses MFA entirely.

These are no longer edge cases. They are mainstream incident patterns.

The browser is no longer just a rendering engine. It is the operating environment for SaaS, identity, and AI driven workflows. And yet many organisations still treat it as a trusted surface rather than a security boundary.

---

The Threat Shift

Identity is widely described as the new perimeter. That position is formalised in NIST SP 800-207 Zero Trust Architecture, which defines continuous verification and policy enforcement close to the resource as foundational principles.

But SaaS changed something important.

Data now lives inside browser sessions.
OAuth grants API access without passwords.
Session tokens bypass MFA once issued.
Generative AI tools accept unstructured prompts that may include intellectual property or regulated data.

Industry reporting reflects this shift. The Microsoft Digital Defense Report highlights adversary-in-the-middle phishing and token theft. Incident analysis in the Mandiant M-Trends Report and the CrowdStrike Global Threat Report shows attackers increasingly leveraging valid session tokens to persist inside cloud and SaaS environments without triggering traditional alerts.

When attackers compromise a SaaS session, they do not need lateral movement. They already have authenticated access to the application layer.

Session hijacking.
OAuth abuse.
Shadow AI usage.

These are browser-native attack paths.

---

Mapping the Pattern

If we map these behaviours to the MITRE ATT&CK Enterprise Matrix, they align with:

• Valid Accounts
• Abuse of Delegated Credentials
• Exfiltration Over Web Services

The tactics are not new. The execution layer is.

If your Zero Trust strategy stops at device compliance and MFA, you have hardened the front door while leaving the interaction layer largely implicit.

The browser has become the operational perimeter whether we planned for it or not.

---

In Part 2, we will look at how to enforce Zero Trust at the browser layer using deterministic, productivity-preserving controls.

👉 Read Part 2: Enforcing Zero Trust at the Browser Layer