receiving, via a processor, identity provider (IDP)/single sign on (SSO) data from at least one of an IDP compute device or and an SSO compute device, the at least one of the IDP compute device or the SSO compute device managing access to a plurality of cloud-based applications for a plurality of user compute devices for a plurality of users;

receiving, via the processor and from the plurality of user compute devices, browser extension data, the browser extension data captured via a plurality of browser extensions at the plurality of user compute devices;

generating, via the processor and without accessing the plurality of cloud-based applications, analytics based on the IDP/SSO data and the browser extension data;

causing, via the processor, an action based on the analytics;

determining, via the processor, a remedial action to improve cybersecurity associated with the plurality of users and the plurality of user compute devices, based on the analytics; and

causing, via the processor, an indication of the remedial action to be displayed.