--- title: Most Security Questions Are Answered Only After the Risk Has Occurred description: As work shifts to browsers, critical security gaps are emerging. Explore why identity, AI, and SaaS risks often remain invisible to traditional controls. image: https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-Header-2.jpg --- [![CXANZ+Citrix LockUp Black RGB](https://www.cxanz.com/hubfs/Australia/Projects/CXANZ/AUS-HSM-CXANZ/Brand%20Assets/CXANZ+Citrix%20LockUp%20Black%20RGB.svg)](https://www.cxanz.com/) - [Home](https://www.cxanz.com) - [Partners](https://www.cxanz.com/partners) - [Customers](https://www.cxanz.com/customers) - [Blog](https://www.cxanz.com/blog) - Resources - [Find a Partners](https://www.cxanz.com/psp-partners) - [Contact us](https://www.cxanz.com/meet-the-team) Product & Solution Updates # Most Security Questions Are Answered Only After the Risk Has Occurred As work shifts to browsers, critical security gaps are emerging. Explore why identity, AI, and SaaS risks often remain invisible to traditional controls. [Wayne Baker](https://www.cxanz.com/blog/author/wayne-baker) Oct 13, 2026 --- # Security questions are often answered one layer too late *In my last post, I asked the question that tends to produce an uncomfortable silence in customer conversations: how are you governing what **actually happens** inside the browser today? This time I want to explain why that silence exists — and why the architecture most organisations have built was never designed to see it in the first place.* **The model we built for a different problem** For the better part of two decades, enterprise security revolved around two fairly simple ideas: secure the network and secure the device. Every product category, every architecture decision, every reassuringly complex diagram (I’m definitely guilty of this) was built on those foundations, because that was where the work happened. Zero Trust Network Access was the right response when that model began to unravel. Verify the user, check the device, grant access only to the application(s) they actually need, and keep checking. Every major vendor now has a serious ZTNA offering — Zscaler, Netskope, Palo Alto, Cloudflare, Citrix — and the category has grown up considerably. This isn’t an argument against ZTNA. It remains necessary. But ZTNA controls the door; once everyone’s inside and helping themselves to the biscuits, it’s largely stopped paying attention. Which is slightly awkward, because according to [LayerX Browser Security Report 2025](https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf), around **85% of the working day now takes place in the browser** — which is where most of the actual activity, and a fair bit of the risk, lives.  ![](https://www.cxanz.com/hs-fs/hubfs/undefined-2.png?width=564&height=528&name=undefined-2.png)  **Figure 1: What ZTNA sees vs what actually happens** The real action happens in the browser, not on the network. Before any traffic left the device, ZTNA checked the badge at the door – but what happens in the room, stays in the room. **The identity problem nobody wants to talk about** There's a dimension to this I find particularly uncomfortable. It's not just that the browser is ungoverned - especially so on BYOD — it's that much of the identity activity taking place inside it is effectively invisible to the corporate identity stack. *Right now, somewhere in your organisation, someone is pasting source code into ChatGPT using their personal Google account. Someone else is summarising a board paper in Gemini. Nothing stopped them — and nothing logged it.* LayerX's 2025 telemetry from millions of enterprise browser sessions puts some rather uncomfortable numbers against it.  ![](https://www.cxanz.com/hs-fs/hubfs/undefined-3.png?width=720&height=276&name=undefined-3.png) **Figure 2: SaaS and AI access via unmanaged personal accounts** You can't revoke access you didn't grant, and you can't *audit* sessions you can't see. Your ZTNA deployment, your CASB, and your DLP suite collectively miss most of this — because the action happens inside the unmanaged browser using a personal device and account, before any corporate control has a chance to fire. **A fair word about in-line CASB** I want to be precise here rather than broad, because the better SSE platforms — Zscaler and Netskope among them — do include in-line CASB capabilities that are genuinely valuable. They inspect traffic between the user and SaaS application and can catch certain classes of data movement: file uploads to unsanctioned destinations, access to known-risk domains. That capability is important, and not something to casually dismiss. But traffic inspection and browser-layer control operate at different levels of the stack, and that distinction matters more than it might first appear. ![](https://www.cxanz.com/hs-fs/hubfs/undefined-4.png?width=585&height=483&name=undefined-4.png) **Figure 3: Where each control reaches (and where the gaps are)** This isn't a criticism of CASB as a category. It's simply an acknowledgement that the control plane sits at the wrong layer for where much of the risk now lives. [Gartner](https://www.gartner.com/en/newsroom/press-releases/2025-04-29-gartner-predicts-25-percent-of-organizations-will-use-secure-enterprise-browsers-to-enhance-remote-access-and-endpoint-security-by-2028)’s own forecasting points the same way, predicting that 25% of organisations will deploy a secure enterprise browser by 2028 specifically to address gaps that network-layer controls can't reach — up from fewer than 10% today. **So what does the right architecture look like?** The instinct when a gap like this appears is to add another tool: another console, another policy model, another vendor relationship. In practice, that instinct rarely improves matters. The seams between tools are often where the risk concentrates, and adding more tools tends to create more seams. What changes the picture is shifting the control plane into the browser itself and aligning it with the same identity and access model that governs everything else. Governance at the surface where work actually happens, rather than inspection at the network perimeter after the fact. In the next post I’ll explore what that looks like in practice from a Citrix perspective — specifically how Citrix SecurAccess ZTNA and Citrix SecurAccess with Chrome Enterprise can be used together, and why thinking in terms of user types is often a more useful way to decide what level of control is actually required. [Product & Solution Updates](https://www.cxanz.com/blog/tag/product-solution-updates) ## Similar posts Industry News & Trends ### [Designing Modern Workspaces Amid Ongoing Hardware Market Change](https://www.cxanz.com/blog/designing-modern-workspaces-amid-ongoing-hardware-market-change) A platform‑led workspace strategy with Citrix and Unicon delivers consistent access, security, and experience across a wide range of devices. Chris Downes Feb 23, 2026 Industry News & Trends ### [Citrix Connect Pulse Sydney 2026: Building the Future of Secure Digital Work](https://www.cxanz.com/blog/citrix-connect-pulse-sydney-2026-building-the-future-of-secure-digital-work) Discover insights from Citrix Connect Pulse Sydney 2026, focusing on secure digital work and the evolving needs of diverse workforce personas. Roshantha Pillay Sep 23, 2026 Industry News & Trends ### [Why VDI Is Still One of the Smartest Moves You Can Make](https://www.cxanz.com/blog/why-vdi-is-still-one-of-the-smartest-moves-you-can-make) Discover why Virtual Desktop Infrastructure (VDI) remains crucial for modern hybrid work environments and how Citrix's latest advancements enhance... Kieran Davies Jul 27, 2025 [![CXANX+Citrix-LockUp-White](https://www.cxanz.com/hubfs/Australia/Projects/CXANZ/AUS-HSM-CXANZ/4.%20Blog/CXANX+Citrix-LockUp-White.svg)](https://www.cxanz.com/) Cloud Software Group and any trademarks, service marks, trade names, and logos of Cloud Software Group (including Citrix and NetScaler) are owned by Cloud Software Group, Inc. and/or its affiliates and are used by Dicker Data under license from Cloud Software Group, Inc. Dicker Data Ltd is a strategic partner of Cloud Software Group, Inc. and is not a corporate subsidiary or agent of Cloud Software Group, Inc. and/or of its affiliates. Copyright © 2026  Dicker Data Ltd. All rights reserved. ABN 95 000 969 362 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Wayne Baker", "url" : "https://www.cxanz.com/blog/author/wayne-baker" }, "dateModified" : "2026-10-13T20:25:36.524Z", "datePublished" : "2026-10-13T20:06:12.000Z", "headline" : "Most Security Questions Are Answered Only After the Risk Has Occurred", "image" : [ "https://www.cxanz.com/hubfs/AUS-CXA-080-Blog-Header-2.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.cxanz.com/blog/most-security-questions-are-answered-only-after-the-risk-has-occurred", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cxanz.com/hubfs/assets/logos/CXANZ-DD-AU.svg" } } } ```