2026 DBIR Highlights Growing Security Risks Inside Browsers

Summary

A sponsored analysis compares Verizon’s 2026 DBIR findings with Keep Aware telemetry, highlighting risks from personal-account AI use, browser credential theft, extensions, ClickFix and phishing, and arguing for browser-level visibility.

Key points

• The DBIR identifies shadow AI as the third most common non-malicious insider action in DLP datasets, with a fourfold year-over-year increase.
• The DBIR says 67% of users access AI services on corporate devices through personal accounts; Keep Aware reports that 23% of sensitive prompt uploads involve personal or unverified accounts.
• The DBIR attributes 39% of breaches to credential abuse. Keep Aware says browser-based credential theft made up about 41% of browser threat activity it observed in 2025.
• Keep Aware reports that 63% of Microsoft-themed phishing sites it observed were not flagged by VirusTotal vendors at employee exposure, and that all credential-theft attempts it observed passed through existing non-browser controls.
• Keep Aware classifies 13% of browser extensions it observed as high or critical risk; it says 93% of poor-reputation extensions were labeled as productivity tools.
• The DBIR found ClickFix accounted for 2.7% of browser-detected attacks. Keep Aware argues that browser-level visibility can help address detection gaps involving social engineering and other browser-based threats.

Vendors

Related Articles

• Three Ways AI Agents Operate in Browsers—and the Security Risksbleepingcomputer.comKeep Aware