Modern attackers increasingly operate at the browser level, where traditional endpoint and network security controls apply, but browser-specific controls are absent.