Resources
What is browser security?
The browser is where most work now happens, and where most of the risk now sits. This is a plain, technical guide to what browser security is, why the browser is hard to defend, the incidents that prove it, and the controls that actually hold.
12 min read
Browser security in one sentence
Browser security is the practice of protecting people, data and credentials at the place they now do most of their work, the web browser. It covers the sites people open, the files they download, the logins they approve, the extensions they install and the data they paste into web apps.
The term used to mean the browser defending itself, through sandboxing, the same origin policy, safe browsing lists and prompt patching. That still matters. It is no longer enough. The browser is now the main interface to company data, and attackers have followed the work there. Modern browser security adds a layer that an organisation controls, so a company can decide what is allowed inside the browser rather than trusting every page and every tab by default.
Why the browser became the workplace
Email, documents, chat, code review, finance, support and customer records all live in web apps now. A laptop can do a full day of sensitive work and never open anything but a browser. AI tools accelerated the shift, because the fastest way to use them is a tab.
That move changed where the risk sits. Sensitive data is read, typed, pasted and uploaded through the browser all day. A login to any of these systems is approved in the browser. The decisions that leak data or let an attacker in are made at the point of the click, inside the page, where the older security tools were never designed to watch.
45%
of employees now use AI regularly on corporate devices, up from 15% a year earlier
Source: Verizon 2026 Data Breach Investigations Report
The design problem: the browser trusts the page
The browser is built to run whatever a site sends it. That is the point of the web. Each page brings its own code, its own scripts and often dozens of third party components, and the browser renders them so the page works. The user sees one clean window. Behind it, a lot of untrusted code is running.
Two design facts make this hard to defend. First, the traffic is encrypted and goes to domains that look fine, so a tool watching the network sees an ordinary connection to a trusted site and nothing worth stopping. Second, the browser keeps a session cookie after a login so the user does not have to sign in on every click. That cookie is proof of identity. If it is stolen, it is as good as the password and the second factor combined.
So the browser, by design, runs untrusted code, hides its content from the network behind encryption, and holds a reusable proof of identity. An attacker who reaches the inside of the page is already past most of the perimeter. This is the gap browser security has to close.
How browser attacks actually work
Most browser attacks do not break the browser. They use it the way it was built to be used, and they aim at the person. The common paths are worth naming plainly, because each one maps to a control.
- Phishing and fake logins. A page that looks like a real sign in collects the password, and increasingly proxies the real login behind the scenes to also steal the session cookie, which slips past multi factor authentication.
- Session and token theft. Once the cookie or token is taken, the attacker replays it and is inside the account without ever touching the password again.
- Malicious and compromised extensions. An extension has deep access to pages and data. A tampered update, or a new extension that asks for too much, can read what the user reads and send it away.
- Data loss into web apps and AI tools. Customer records, contracts, financial detail and source code get pasted or uploaded into a web app, and leave as ordinary traffic to a domain that looks trusted.
- Dangerous downloads. A file assembles or arrives through the page, named to look safe, and runs on the device before anything inspects what it really is.
- Drive by exploits and browser zero days. A crafted page triggers a flaw in the browser itself, and visiting the page is enough to be hit, which is why emergency patches ship so often.
Four incidents that show the pattern
These are public, reported events. Each one happened through the browser, and each one maps to one of the paths above. The point is not the individual company. It is that the same small set of browser weaknesses keeps producing the headlines.
What the older controls were built for
Organisations already run security tools, and they do real work. The issue is that each was built for a layer that is next to the browser, not inside it.
A secure web gateway protects the wire. It filters traffic as it leaves the network and stops known bad destinations. It assumes a healthy corporate network, and to it a paste or an upload into a trusted AI domain looks like ordinary encrypted traffic. Endpoint tools protect the disk. They are strong on files at rest and on what leaves through the device, but a login approved on a lookalike page, or data typed into a web app, can pass before they have anything to act on. Group Policy sets configuration, but it does not watch what happens at the point of the click. The table below sets the layers side by side.
What good browser security looks like
A control that actually closes the gap has to act at the point of use, inside the browser and on the device, before data leaves. In practice that means a short list of capabilities that work together.
- It decides allow, warn or block at the click, and ties every decision to a named user on a named device.
- It governs AI use at the level that matters, so chat can be allowed while file uploads are blocked, rather than banning the tool and pushing people to personal accounts.
- It stops fake logins, lookalike and typosquatted domains at the click, including the kits that proxy the real page to steal the session.
- It checks downloads by their true type rather than their name, before they reach the disk.
- It keeps enforcing when the network path or the gateway is down, so protection does not depend on a single point of failure.
- It shows which sites, AI tools and extensions people actually reach, so shadow use becomes a list you can act on rather than a guess.
- It runs in the browsers people already use, and applies policy by department from your identity provider.
Where Enforce comes in
Enforce is browser security built for the layer the older tools cannot see. It enforces policy inside the browser and on the endpoint, at the point of use, before data leaves the device. Every action is tied to a named user on a named device and recorded in a time ordered log.
It governs AI use one control at a time, so you can allow chat and block uploads without banning the tool. It stops fake logins, lookalike domains and the phishing kits that steal sessions, at the click. It checks downloads by their real type before they land. It shows the sites, AI tools and extensions your people reach, including the ones nobody has classified yet, so you can act on a list instead of a hunch.
Enforce does not replace your browser or your gateway. People keep the browser they already use, and the gateway keeps protecting the wire. Enforce runs alongside the gateway at all times and governs what it cannot see inside the browser. If the network path fails, protection keeps enforcing rather than switching off.
Where to start
Browser security is not a single product you bolt on. It is a layer you add where the work and the risk now sit. The practical first step is visibility, not a blanket block.
Start in watch mode on a group you choose. See which sites, AI tools and downloads would have been stopped, and what your people actually do in the browser, before anything is switched on. Once the picture is clear, turn on the controls that match the risk, by department, and keep the log as your record.
A gateway protects the wire. Enforce governs the browser.
Each existing control covers part of the job. All of them assume the user stays on a healthy corporate network.
See Enforce on your own traffic.
We start in watch mode on a group you choose and show you what Enforce would have blocked before anything is switched on.
Talk to sales