What if the biggest blind spot in cybersecurity today is the place where most work actually happens, the browser?

In this episode of the Business of Cybersecurity podcast, I sat down with Adam Bateman, co-founder and CEO of Push Security, to explore a growing shift in how modern attacks are carried out and why traditional defenses are increasingly struggling to keep up. Adam brings a rare perspective to the conversation, having spent years in offensive security and red team operations simulating real-world attacks against major enterprises before founding Push Security.

One of the central ideas we unpacked is the claim that the browser has quietly become the new endpoint. As organizations move more work into cloud applications and SaaS platforms, the connection between users and company systems increasingly runs through the browser rather than traditional networks or local applications. The problem is that most security tools still focus on endpoints, networks, and email. That leaves what Adam describes as a “missing middle,” the space between a user logging in and the moment a breach is discovered.

We also discuss how phishing attacks have evolved beyond the inbox. Push has observed that as much as thirty-four percent of the malicious phishing attempts they detect now originate outside email, appearing instead through platforms like LinkedIn messages, Google search results, or other online channels. These platform-native attacks bypass traditional email gateways entirely, often targeting senior executives and employees with privileged access to business systems.

Adam also shares insights from a recent campaign his team uncovered called ConsentFix, an attack technique that combines browser manipulation with OAuth consent abuse. Instead of exploiting software vulnerabilities or deploying malware, these attacks manipulate trusted workflows inside cloud platforms and identity systems. The result is a compromise that can occur entirely within a browser session, often without triggering traditional security alerts.

Throughout our conversation we explore why these browser-native threats are growing, how attackers are using AI to scale social engineering campaigns, and why visibility into browser activity may become one of the most important capabilities for modern security teams. Adam also explains how Push Security approaches this challenge by bringing real-time detection and response directly into the browser environment where work and attacks increasingly collide.

If cybersecurity teams are still focused only on networks, endpoints, and email, they may be missing the layer where attackers now spend most of their time. As work moves deeper into cloud platforms and SaaS tools, could the browser become the next frontline in enterprise defense?