Update for everyone - the popup window needs to spied as a separate Business Object. You can initially launch the browser, attach to the browser, then detach from the browser when the Windows security pop up is visible on screen, and attach to that as a separate Business Object.
Hope this helps.