It is relatively easy to override certificate pins by modifying the browser that's installed on the corporate network. In those places where they are adding a

It is relatively easy to override certificate pins by modifying the browser that's installed on the corporate network. In those places where they are adding a "trusted" local middlebox CA to the client for interception, modifying the browser's pin store (or its logic) is not such a big stretch on top of that. At least other devices, such as users own devices on the corporate network, are immune to this.