Article written by Andrius Buinovskis, VP of product strategy at NordLayer
EDR remains necessary when attackers execute code on the host. The problem starts if teams expect EDR to flag every anomalous action, including browser-based SaaS activity that may look like a normal user session from the endpoint.
In SaaS-heavy environments, an employee can authenticate to a cloud application, approve an OAuth request, open sensitive files, or upload data through a browser session. The action may never create a new attacker-controlled executable or a process that endpoint defenses would classify as malicious.
Like in the 2025 Salesloft Drift incident: UNC6395 obtained OAuth tokens associated with Drift integrations and used them to make high-volume API calls against customers’ Salesforce environments. This way, authenticated SaaS access enabled data theft without a malware process for EDR to inspect.
The browser has become the primary access layer for corporate SaaS applications, identity workflows, files, and admin consoles. NordLayer’s Browser Security Report 2026 found that browser access is present across the full set of 504 reviewed applications, with 79% of tools available only through the browser.
That makes browser sessions a core location for user actions that may not produce the endpoint artifacts EDR was built to analyze.
EDR still detects host execution, malware, persistence, and process-level behavior. But in SaaS-heavy environments, some attacks are carried out through browser and identity workflows that do not create the endpoint artifacts EDR is built to inspect.
In adversary-in-the-middle phishing attacks, malicious browser extensions, unauthorized uploads, or clipboard-based execution lures, the decisive action happens inside the browser or the cloud application.