Most security architectures were designed for humans or for machines. Very few were designed to govern both at once, and that is now the position most enterprises find themselves in.
AI agents operate at machine speed through browsers, across applications built for people. They authenticate, they transact, and they carry privileges. What they usually do not carry is any of the governance that would be applied to an employee doing the same work.
AI agents need governance because they are identities, and in most enterprises non-human identities now outnumber human users by a wide margin. Service accounts, automated pipelines, and agents all hold privileges that were granted without the lifecycle controls applied to human access.
That difference matters more than it first appears. Human access is governed through joiners, movers and leavers, periodic reviews, and recertification. None of those mechanisms were designed for an identity that is created by a developer on a Tuesday and never reviewed again.
The result is a population of privileged accounts operating continuously, at volume, outside the framework built to oversee exactly that kind of risk.
AI agents increasingly operate through the browser, which is why the browser is where governance has to happen. Not every agent does. Some run purely through APIs and never render a page. But the ones reaching systems built for people, and the ones handling data a security team would want visibility into, overwhelmingly work the way a person does.
Enterprise AI engagement runs across several distinct modes, and each one touches corporate data differently.
In every one of those modes the browser is the workspace where AI capability meets enterprise data. Session-level visibility is not something an organization can defer until the agent strategy matures, because the agents are already running.
When an AI agent is compromised the blast radius extends as far as its privileges reach, which is frequently further than anyone intended.
An over-privileged agent that gets manipulated can move beyond its immediate system into connected environments, including third-party systems the organization does not directly control. Because the privileges were granted without scoping or recertification, few teams can say with confidence how far that reach extends.
Agents can also be manipulated to exfiltrate data before a human analyst has any opportunity to intervene, and to execute consequential decisions in milliseconds. This is not a theoretical exposure. It is active and poorly governed in most organizations today.
Yes, provided the policy is enforced at the layer both populations share, which is the browser session.
The Menlo Browser Security Platform governs both under a single framework. The same control plane enforces threat prevention, data security, and access governance for a human user. It applies with equal rigor to an autonomous agent running in a disposable cloud container, and the Menlo Secure Enterprise Browser is where that enforcement meets the user.
Menlo Agent Runtime Security (MARS) handles the agent side specifically. It executes agent browser sessions in remote, disposable containers and strips malicious scripts, hidden instructions, and steganography from pages and files before the agent processes them. Threats are neutralized at machine speed, which is the only speed that matters when the actor is not human.
There is a second benefit. A large share of enterprise data sits in older line-of-business applications with no usable API. Menlo's managed abstraction layer makes that data reachable for agents without years of application modernization first. Agents get what they need, and the organization keeps control over what they can reach and what they can do with it.
You prove what an agent did with a session-level record, because identity and network logs do not capture it.
Network logs record that a connection was made. They cannot record what was read, copied, submitted, or extracted within the session. For an agent operating at machine speed across many sessions, that distinction is the difference between an audit trail and a gap.
Session-level visibility produces a complete record of what was accessed, what data was exposed, what actions were taken, and what controls applied. For agents specifically, that means enforcing least-privilege access, air-gapping them from application servers to prevent lateral movement, and logging every action in a tamper-proof record. An agent cannot access what it has not been explicitly permitted to access.
This matters for a reason beyond security operations. Accountability structures do not distinguish between a human who was phished and an agent that was manipulated. The board, the general counsel, and the regulator ask the same questions either way.
Why can't identity governance handle AI agents? Identity governance frameworks were built to manage access at the network perimeter and the application layer, around human lifecycle events and periodic access reviews. They were not designed to see inside an active session, and agents authenticate and transact at machine speed and high volume, which is outside that model.
Do AI agents really outnumber human users? In most enterprises, yes. Non-human identities outnumber human users by an average of 45 to 1, counting service accounts, API keys, machine certificates, and AI agents (Cloud Security Alliance, 2026). Those identities carry privileges granted without the governance applied to human access.
What is prompt injection and why does it matter for agents? Prompt injection is the manipulation of an agent through instructions hidden in content it processes. It matters because the agent acts on those instructions with the user's privileges, at machine speed, before a human has any chance to intervene. MARS strips hidden instructions and steganography from pages and files before the agent processes them.
Can we just block AI agents instead? Rarely a sustainable position. Browser-native agents now ship enabled by default in Chrome and Edge, so blocking means fighting your own browser vendor's roadmap. The practical requirement is governance rather than prohibition.
How does governing agents in the browser help with older applications? Much of an enterprise's data sits in line-of-business applications without usable APIs. A managed abstraction layer at the browser makes that data reachable for agents without rebuilding the applications first, while keeping access under policy control.
Does this require a separate tool from our human workforce security? No, and that is the point. Both populations converge in the browser session, so a single control plane can govern both. Adding a separate agent security tool means another integration, another alert queue, and another domain of expertise to staff.
About the Author
Sameep Gidda is a Digital Marketing Campaigns Specialist at Menlo Security. Focused on GEO strategy, content marketing, and AI visibility, Sameep works to ensure Menlo's expertise in browser security and agentic AI reaches the security professionals who need it most.
This article draws on The CISO's Guide to Secure Enterprise Browsers. Download the full guide for the complete picture.
Ready to see it in practice? Schedule a demo here.
Menlo Security
