D&B Gained Full Visibility and Control Over Browser-Based Risks

Web and SaaS applications are the easiest channels for insider threats and inadvertent data leakage. Nearly all users have internet access from the browsers on their endpoints, meaning they can use it directly to exfiltrate data without having to connect external devices (such as USB drivers) or connect to outside networks. In most cases, it is the path of least resistance.

On these platforms, data is no longer a discrete file that traverses known channels like email. Instead, it stays embedded within real-time cloud-based applications, accessed and manipulated entirely via the browser.

Traditional SASE, DLP, and endpoint solutions provided strong control over ingress and egress traffic but little insight into the browser itself. While these tools could filter URLs, categorize sites, and protect file-based uploads, they lacked visibility into what users were actually doing inside web sessions:

• Which SaaS apps they were logging into
• Whether they were using personal identities
• What extensions were being used
• What data was being copied or pasted

The result was a visibility gap around which SaaS apps employees were using, file-less data activity, browser extensions, shadow identities, and more. Sensitive data could be shared or exfiltrated without detection, and identity misuse was difficult to track. D&B wanted to gain visibility into its users’ browsing sessions to detect and control shadow SaaS usage and ensure employees weren’t exposing internal documents or customer data on sanctioned apps. They needed an easy-to-deploy solution that covered web DLP without impacting user experience.

Akamai Workforce Protector provided D&Bʼs security team with complete visibility into browser activity, identifying which tools are accessed, by whom, through which accounts (corporate or personal), and what data is going through them. It controls both file-based and file-less data transfers, such as text input, copy/paste, and file sharing, by using real-time classification and labeling to detect sensitive data shared with SaaS apps and unsanctioned services.

It also provided visibility into extensions, scripts, and all user actions in the browser. From detecting risky plug-ins to blocking unauthorized data uploads, Workforce Protector became D&Bʼs “EDR for the browser.”

Deployed as a lightweight browser extension, Workforce Protector required no workflow changes. It monitored activity in real time, classified data contextually, and enforced granular policies with enforcement options, ranging from monitoring only to warning users with customizable messages, to masking sensitive data, to completely blocking their actions.

Preventing GenAI data leakage has become an industry-wide problem. The widespread use and convenience of AI-driven tools and AI-powered browsers, and the lack of awareness, result in employees unknowingly sharing proprietary and confidential information while seeking assistance, developing code, or generating content. GenAI tools transmit all data uploaded to them to external LLMs. This creates security risks as such data might be stored remotely, used for LLM training, or exposed to third parties. This unintentional data sharing can compromise the organization’s security posture and expose it to legal and compliance risks.

Traditional security measures such as SASE/SSE, Network DLP tools, and employee training programs are not fully equipped to handle the unique risks posed by AI-driven tools. While they can enforce file-centric data transfer restrictions, the main issue arises when there is file-less data activity like copy/paste, text input, etc. This means that despite efforts to secure data, there was a gap in effectively monitoring and controlling how employees interact and use AI tools.

While some organizations block AI altogether, D&B recognized the productivity advantages of AI tools and how they could enable its business to operate more efficiently. D&B wanted a solution to let employees use these tools to boost innovation without risking sensitive data leakage.

Since the browser is the primary point of access for AI tools, it has become the main channel for both usage and risk. To gain complete control and visibility over AI interactions, D&B needed dedicated browser-based protections that could monitor, analyze, and enforce policies at the exact point where data is entered and shared.

Workforce Protector is deployed directly within the browser, giving it direct visibility and control over all AI activity. It monitors user actions such as browsing activity, login attempts, data input, and file uploads, identifying which tools are accessed, by whom, and through which accounts (corporate or personal). This enables organizations to detect unauthorized data sharing and enforce policies to block unsanctioned shadow AI applications and redirect users to sanctioned ones.

Workforce Protector permits organizations to enforce last-mile controls on GenAI tools and AI-enabled SaaS applications, directly within the browser, with granular enforcement options ranging from monitoring only to warning users with customizable messages, to masking sensitive data, to completely blocking their actions. By leveraging advanced algorithms and real-time analysis, Workforce Protector detects and prevents typing, copy/paste, or sharing files with sensitive data, ensuring confidential information is not exposed. This proactive approach enables organizations to benefit from the productivity capabilities of AI while maintaining stringent data security standards.

The D&B team deployed Workforce Protector on the browser to secure employee interaction with GenAI tools and allow them to use it without compromising security.

Browser extensions have become both powerful and dangerous, often requesting broad permissions that expose organizations to risk. They have also become a key component in attackers’ toolkits. Attackers use social engineering or silent sideloading to install malicious extensions that gain full access to browser data, cookies, etc. Once installed, malicious extensions have direct access to all of the browser’s data and activities, making it possible for the attacker to exfiltrate them at will.

Existing tools offer little visibility into extension activity and rely on manual blocklists, making it difficult to detect threats in real time. For D&B, detecting and managing these extensions’ allowlists at scale had been historically difficult and resource intensive. As an “open” organization that is attuned to its employees, D&B did not want to block all extensions. This is why D&B was looking for automated processes that allowed safe, productivity-boosting extensions, while blocking malicious ones.

As SaaS usage explodes across organizations, users frequently use unsanctioned SaaS applications, which are not known or monitored by the organization. Access to such shadow SaaS apps is often through personal accounts or nonfederated corporate accounts, which expose D&Bʼs data and identities to threats invisible to traditional tools. These shadow identities make it impossible to track what data is being accessed or shared, and by whom. The problem is amplified in multi-tenant SaaS apps, in which a single user might log in through multiple accounts, blurring the lines between corporate and personal usage.

This results in fragmented identity governance, reduced visibility, and a complete lack of control over access policies and data flows. Security teams are left guessing which users are accessing which accounts, whether corporate data is being shared outside approved boundaries, or if malicious insiders are exploiting unmanaged accounts to exfiltrate sensitive information.

D&B wanted to shine a light on this visibility gap and ensure that SaaS access and activity were governed not just at the app level, but at the user identity level. They needed to detect unmanaged identities in use across their environment, block unauthorized access, and ensure that only approved, SSO-backed identities could interact with sensitive data.

Workforce Protector provides granular identity-aware visibility and control over every SaaS login and session at the browser layer. It tracks which user is logging into which SaaS application, through which identity (SSO, corporate, personal, or shared), and what actions they’re taking. This unique vantage point enables full monitoring of shadow identities that operate outside SSO or IAM controls.

Using Workforce Protector, D&B was able to discover unmanaged SaaS accounts being used in the browser, whether they were personal accounts or nonfederated identities, and enforce granular policies to restrict or block their usage. It provides full visibility and enforcement of browser-based identity governance, including password strength, password reuse, account sharing, non-SSO corporate accounts, OAuth permissions, and more. “Before LayerX, tracking which identities employees used across SaaS was nearly impossible. Now, we can detect personal logins instantly and enforce identity consistency across all sessions, ensuring data stays within approved boundaries,” said Jay DePaul, CISO of Dun & Bradstreet.

Workforce Protector ensures that only verified corporate identities can access SaaS apps and perform activities such as uploading files, generating or viewing documents, or sharing external links. In addition, Workforce Protector blocks personal account logins and enforces identity consistency across sessions, creating a secure, identity-governed SaaS environment with minimal friction to end users.

Workforce Protector has become a critical pillar of D&Bʼs security stack, complementing their SASE and endpoint defenses with real-time visibility and control over browser activity, the modern workspace where business happens.

With Akamai Workforce Protector, D&B can:

• Protect sensitive data from file-less exfiltration
• Enable safe and productive GenAI exploration
• Govern identity use across SaaS and AI apps
• Defend against malicious extensions and scripts

By embedding browser-native protection into its defense-in-depth strategy, D&B has strengthened its ability to protect data, identities, and innovation without compromising user experience or productivity. Workforce Protector ensures that the browser becomes an enabler of secure innovation. Its lightweight deployment, identity-aware protection, and file-less DLP capabilities make it an ideal solution for fast-moving, cloud native teams who need both flexibility and control. “What stood out with Akamai Workforce Protector was its ability to strengthen security without slowing anyone down. It protects our data, identities, and AI usage while keeping the employee experience frictionless and management overhead minimal,” concluded DePaul.

Dun & Bradstreet provides the verified commercial identity foundation for enterprises to deploy AI at scale. The company originated the D‑U‑N‑S^® Number in 1963, now the global standard for identifying commercial entities. Anchored by this identifier, the D&B Commercial Graph^™ structures and connects business identity consistently across systems, enabling AI to operate on accurate, validated data. Since 1841, businesses of every size have relied on Dun & Bradstreet to navigate change and accelerate growth.