Keep Aware Report Finds Enterprise Browser Security Gaps as AI Use Grows
Summary
Keep Aware’s sponsored 2026 report says enterprise browser security lags AI adoption. Its telemetry found sensitive web-app inputs split between corporate (54%) and personal or unverified work accounts (46%), with phishing, risky extensions and social engineering among
Key points
- The report describes browsers as a growing execution layer for AI-assisted work, while enterprise security controls have not kept pace.
- Keep Aware telemetry found 41% of end users interacted with at least one AI web tool; employees used an average of 1.91 AI tools each.
- In a one-month snapshot of authenticated sessions, 54% of sensitive inputs to web apps went to corporate accounts and 46% to personal or unverified work accounts.
- For 2025, Keep Aware listed phishing (29%), suspicious or malicious browser extensions (19%), and social engineering (17%) as leading attack categories.
- The report says phishing domains had a median age over 18 years and describes cloaking, chained redirects, CAPTCHA gates, and conditional execution as ways campaigns can evade scanning.
- Keep Aware classified 13% of unique installed extensions as High or Critical risk, citing broad permissions that can expose browsing activity and sensitive data.
- The report recommends continuous browser-native visibility and control for in-session data exposure, AI use, and extension risk.
Article Details
- Publisher
- Keep Aware (sponsor and report author)
- Report Period
- 2025 telemetry; 2026 report
- Scope
- Enterprise browser security, AI tool usage, sensitive data exposure, browser-based attacks, and extension risk.
- Sample Size
- Not disclosed
- Key Statistics
- In Keep Aware's 2025 telemetry, 41% of end users interacted with at least one AI web tool; employees used an average of 1.91 AI tools per person.
- In a one-month snapshot of authenticated sessions, 54% of sensitive inputs to web apps went to corporate accounts and 46% to personal or unverified work accounts.
- Keep Aware observed phishing (29%), suspicious or malicious browser extensions (19%), and social engineering (17%) as primary attack categories in 2025.
- In 2025 telemetry, 13% of unique installed extensions were classified as High or Critical risk.
- The median age of phishing domains was reported as over 18 years.
- Recommendations
- Use browser-native visibility and controls to monitor AI usage, SaaS activity, and in-session behavior in real time.
- Continuously review browser-extension permissions, updates, and real-world behavior rather than relying only on static allowlists or point-in-time reviews.
- Assess sensitive data exposure based on the account used and activity within browser sessions, not only on which SaaS application is accessed.