The browser may be the missing control point in enterprise security, says Island’s ANZ Managing Director

What if the browser is where enterprise control should have been built all along?

In this interview at Security Edge, Nick Lennon argued that many of the layers organisations have added to secure user activity exist because the browser was never designed for enterprise use.

His point was that control has sat too far away from the place where work actually happens.

By moving policy enforcement closer to the user interface, organisations can reduce security complexity while gaining more visibility over behaviour, data movement, and AI usage.

Key takeaways:

• Consumer browsers have forced enterprises to build layered controls around an environment they do not directly manage.
• Bringing policy enforcement into the browser can simplify architecture while improving visibility and control over user behaviour.
• A more unified browser layer can help organisations govern AI use more consistently while supporting safer productivity gains.

Consumer browsers create enterprise workarounds

Modern security stacks have grown partly because enterprises have never had much direct control over the browser itself.

Relying on consumer browsers has forced organisations to build layers of controls around them, adding secure web gateways, DNS proxies, malware protections, and other monitoring tools behind the browser.

That has increased cost, created more architectural sprawl, and left gaps between where risk appears and where controls are applied.

Nick’s argument was that many enterprises are compensating for a design problem that was never solved at the browser layer.

The browser is becoming a more practical control plane

Embedding policy enforcement into the browser changes where security decisions happen.

Instead of routing traffic through multiple layers of infrastructure to regain control, organisations can apply policies directly in the environment where users are working.

That can simplify architecture while improving user experience.

Nick pointed to browser level controls such as data loss prevention, website access rules, and MFA for legacy applications, all applied without changing the underlying systems.

The shift matters because it brings control closer to the point of action.

AI governance and productivity are starting to converge

Nick also argued that the enterprise browser is becoming more relevant as organisations try to govern AI use without slowing adoption.

When employees are using multiple AI tools, governance can quickly become fragmented.

A single browser based policy layer offers a more consistent way to apply controls across those interactions.

That includes managing prompt activity for audit purposes, enforcing DLP policies across AI tools, and supporting agentic workflows inside a more controlled workspace.

In that model, the browser becomes more than a security layer. It also becomes a place where organisations can support productivity while maintaining oversight.