The browser is where staff now reach most corporate applications and data, yet many organisations buy browser security on a demo of blocked copy and paste without deciding which problem they are paying to solve. The market spans managed mainstream browsers with native policy, browser security extensions, purpose-built enterprise browsers, remote browser isolation and network or security service edge (SSE) controls that inspect traffic outside the browser. This vendor-neutral guide helps security architects, end user computing teams and procurement decide which category fits, write requirements and RFP questions, compare offers on evidence, understand pricing models and run a proof of concept. For hardening policies and how the controls work, see the Enterprise Browser and Browser Security Guide.
Key takeaways
- Start with the native browser you already manage. Chrome and Edge enterprise policies, extension control and Safe Browsing or SmartScreen cover much of the baseline at no extra licence cost; buy only for the gap that remains.
- Unmanaged devices decide the category. If contractors, BYOD or third parties need governed access, an enterprise browser or isolation is usually needed; on fully managed devices an extension or native controls may be enough.
- Enforcement depends on identity. Any browser control can be bypassed by opening another browser unless the identity provider accepts sessions only from the governed browser or profile.
- Browser detection and response needs telemetry, not just blocking. Require structured events for extension installs, password reuse, malware transfer and sensitive data transfer, streamed to your SIEM.
- The product is itself privileged software. A browser security extension or enterprise browser sees every page, cookie and keystroke; assess its update chain and vendor access as you would an endpoint agent.
Define requirements
Write these down before the first vendor meeting. They decide whether you are buying an enterprise browser, an extension, isolation or nothing new at all.
- Populations and devices: count employees on managed Windows and macOS, mobile users, contractors, outsourced support, BYOD and mergers. Note which populations must reach which applications. An enterprise browser earns its cost mainly where you cannot manage the device.
- Use cases ranked: data loss from SaaS (download, print, paste, upload), generative AI prompt leakage, risky extensions, phishing and credential theft, session cookie theft, drive-by exploits on uncategorised sites, privileged SaaS administration, and browser-based access instead of VPN or virtual desktop. Rank three; vendors will claim all of them.
- Current baseline: which browsers are standard, how policy is delivered (Group Policy, Intune, the Edge management service, Chrome Enterprise Core), whether extensions are blocked by default, and whether Safe Browsing or SmartScreen is enforced. CISA's first recommendation is to "Simplify your web browser infrastructure via standardization", which it calls the easiest, quickest and most cost-effective step.
- Existing controls: secure web gateway or SSE, CASB, endpoint DLP, EDR and remote browser isolation already licensed. Overlap here is the main source of wasted spend; see the SASE and SSE Buyer's Guide.
- Constraints: data residency for browsing telemetry, works council or privacy review of user monitoring, accessibility, legacy applications that need an old rendering mode, and offline use. CISA advises that applications requiring outdated browsers go under strict exception policies with compensating controls.
Size changes the answer. A small organisation on managed devices usually gets most of the value by standardising on one browser, blocking extensions by default with an allowlist, enforcing browser sign-in to the work account and turning on the vendor's built-in safe browsing protection. A large or regulated organisation with third-party access, regulated data in SaaS and a security operations centre is the typical buyer of an enterprise browser or a browser security platform with DLP and telemetry.
Capability areas and evaluation criteria
Products sold as browser security lead with one of the approaches below. Decide which you need before scoring; an enterprise browser and a secure web gateway answer different questions.
| Approach | Where control sits | Strong at | Weak at | Buy it when |
|---|---|---|---|---|
| Managed mainstream browser (native policy) | Chrome or Edge with enterprise policy from MDM or cloud management | Extension control, sign-in, downloads, safe browsing; no new software for users | Advanced data controls often need paid add-ons; little control on unmanaged devices | Fully managed estate; baseline not yet enforced |
| Browser security extension | Force-installed extension inside the existing browser | Fast deployment, extension inventory, phishing and data movement visibility | Runs with extension privileges; bypassed by another browser or profile unless access is restricted | Managed browsers already standard; need telemetry and DLP quickly |
| Enterprise browser | A separate, usually Chromium-based, browser with policy and logging built in | Last-mile controls (copy, paste, print, screenshot, download), per-application policy, unmanaged devices | Another browser to patch and support; users fall back to other browsers unless access is conditioned on it | Contractors, BYOD, third-party access, VDI replacement for web applications |
| Remote browser isolation | Page executes on a remote or cloud container; user receives rendered or sanitised content | Drive-by exploits, uncategorised and high-risk sites | Latency and compatibility; does not stop a user typing a password into a phishing page on its own | High-risk user groups or site categories |
| Network or SSE controls | Proxy or cloud gateway inspecting traffic | Category filtering, malware scanning, CASB for sanctioned SaaS, all applications not only browsers | Limited view of in-page actions and extensions; TLS inspection gaps; no control on unmanaged devices without an agent | Need network-level policy across all traffic |
CISA describes browser isolation as creating "a logical barrier" between the browser and the operating system, and remote browser isolation as one that "transfers the processing of web data off the local system", noting it can cost more up front but less over its lifecycle. The NCSC's browser guidance does not name enterprise browsers at all; it focuses on choosing browsers with "Enterprise management capabilities", safe browsing integration and a policy for third-party extensions. Expect the categories to keep converging: SSE suites add browser extensions, and enterprise browsers add gateway features.
Weight criteria to your ranked use cases. An illustrative split for an enterprise browser or extension evaluation: 25% data and access controls, 20% telemetry and detection, 20% identity integration and enforcement, 15% product and supply chain security, 10% user experience and compatibility, 10% commercial terms.
| Criterion | What good looks like | Weak signs |
|---|---|---|
| Extension governance | Inventory with permissions and install source; default-deny with allowlist; blocking by requested permission; enforcement equivalent to ExtensionSettings fields such as installation_mode, blocked_permissions, runtime_blocked_hosts and minimum_version_required | Reputation scores only; no way to block by permission or remove installed extensions |
| Data controls | Per-application rules for upload, download, paste, print and screen capture; content inspection with your classifiers; generative AI prompt controls; audit-only mode | Only all-or-nothing blocking; no content inspection; rules not testable before enforcement |
| Phishing and credential protection | Password reuse detection on non-corporate sites, safe browsing integration, warnings on newly registered domains | Relies solely on URL category lists |
| Session protection | Cookie theft resistance, session binding to device, short-lived sessions for privileged SaaS | No answer for stolen cookies (ATT&CK T1539) |
| Identity integration | SSO with your IdP, conditional access signals (device, browser, profile), managed work profile separated from personal profile | Separate local accounts in the browser console |
| Telemetry | Documented event schema, near real-time streaming to SIEM, extension and data events with user, device and URL | Dashboard only; CSV export; events delayed by hours |
| Coverage | Windows, macOS, Linux, iOS, Android as your populations need; managed and unmanaged devices | Desktop only; mobile "on roadmap" |
| Update cadence | Chromium security fixes shipped within a stated number of days of upstream; auto-update enforced | No stated patch lag; manual updates |
Browser detection and response
Browser detection and response means collecting in-browser events and acting on them, not only enforcing policy. Native platforms already emit useful events: Chrome's reporting connectors send threat events including Extension install, Malware transfer, Password reuse, Password breach, Suspicious URL and Unsafe site visit, while data protection events (Content transfer, Sensitive data transfer, URL filtering) require a paid add-on. Edge for Business has Microsoft Purview DLP built in, with allow, block and audit actions for upload, download, copy, paste and print. Ask third-party products to match or exceed this and to map detections to ATT&CK T1176.001 Browser Extensions, T1539 Steal Web Session Cookie and T1185 Browser Session Hijacking. Response actions to test: disable an extension across the estate, revoke a user's sessions, force a browser update, and quarantine a profile.
Pricing models
Browser security pricing is rarely published. Native management of mainstream browsers is generally included; data protection features are often a paid add-on or consumption-billed.
| Model | What is counted | Watch for |
|---|---|---|
| Per user | Named employees and contractors | Whether third-party and seasonal users count at full price |
| Per device | Managed endpoints with the extension or browser | Users with several devices; unmanaged devices excluded |
| Tiered modules | Base management plus DLP, isolation or AI controls | Telemetry streaming or SIEM export sold as a premium tier |
| Consumption | Protected actions or data scanned (for example pay-as-you-go protection for unmanaged applications) | Unbounded cost when scope grows; no budget cap |
| Bundle | Included in an SSE, endpoint or productivity suite | Shelfware if the bundle's browser features are weaker than the standalone need |
Ask for a three-year cost covering employees and third parties at today's numbers and at 30% growth, including isolation minutes or consumption charges, SIEM export and professional services.
Where identity fits
Browser controls are enforceable only if applications refuse sessions from ungoverned browsers. Require integration with your identity provider so that conditional access can require the enterprise browser, a managed work profile or a compliant device for sensitive applications, and test that a personal browser is refused. Separate personal and work profiles: in a 2023 support system breach at an identity provider, a service account credential saved to a personal Google profile on a work laptop was exposed when that personal account was compromised. Browser-stored passwords and session cookies are prime targets for infostealers; see the Token and Session Security Guide.
Framework mapping
| Framework | Reference | What the product should evidence |
|---|---|---|
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality; CM-11 User-Installed Software | Extension default-deny and allowlist; blocked permissions |
| NIST SP 800-53 Rev. 5 | SC-18 Mobile Code; SC-44 Detonation Chambers | Script and site isolation; remote or sandboxed execution of risky content |
| NIST SP 800-53 Rev. 5 | AC-4 Information Flow Enforcement | Upload, download, paste and print rules per application |
| NIST SP 800-53 Rev. 5 | SI-3 Malicious Code Protection; SI-4 System Monitoring; AU-12 Audit Record Generation | Download scanning; browser event telemetry to SIEM |
| MITRE ATT&CK | T1176.001 (mitigations M1033 Limit Software Installation, M1038 Execution Prevention); T1539 (M1021 Restrict Web-Based Content); T1185 | Detections and preventive controls mapped to techniques |
Questions to ask vendors
Use these as the core of a browser security RFP and ask every shortlisted vendor the same questions in writing.
- Which of our ranked use cases do you address natively, which through partners, and which not at all? What do you add over Chrome or Edge enterprise policy we already run?
- How do you stop a user bypassing your controls with another browser, a personal profile or a private window, on managed and on unmanaged devices?
- Which identity providers do you integrate with for conditional access, and can a protected application require your browser or profile as a condition?
- Show your extension controls: can we default-deny, allow by ID, block by permission, remove installed extensions and pin minimum versions?
- How are data rules evaluated (in browser, in cloud), what content inspection is used, can we run in audit-only mode first, and how are generative AI sites and prompts handled?
- What is your event schema, how quickly do events reach our SIEM, and which events are included in the base price?
- How quickly do you ship upstream Chromium security fixes, and how do you enforce updates on unmanaged devices?
- How is your extension or browser published and signed, who in your company can push an update, and what controls protect that release path?
- What browsing data leaves the device, where is it processed and stored, for how long, and can we exclude personal browsing, health or banking categories?
- What exactly counts toward the licence, how are contractors and short-term users counted, and what does 30% growth cost?
Red flags
- Controls that only work if users choose the governed browser, with no identity-based enforcement.
- An extension-based product with no answer to its own supply chain risk. In the 2024 Chrome extension breach at a data security vendor, a phished OAuth consent let attackers publish a malicious version of the vendor's own security extension.
- Patch lag on a Chromium fork that the vendor will not commit to in the contract.
- Telemetry locked in a vendor console, or SIEM streaming sold as an expensive extra.
- Full-page recording or keystroke capture enabled by default without a privacy impact assessment.
- Claims that the product "replaces" SSE, EDR and DLP outright, rather than describing the overlap honestly.
- Data rules that cannot be tested in audit mode, so the first enforcement day breaks business workflows.
Proof of concept
- Pick two populations and three use cases: for example contractors on unmanaged laptops and finance staff on managed devices, with success measures agreed with application owners.
- Baseline: record installed extensions and their permissions, the number of browsers and profiles in use, password reuse alerts and data movement to unsanctioned applications from current tools.
- Connect identity first: configure SSO and a conditional access rule that requires the governed browser or work profile for one test application, and confirm a personal browser is refused.
- Run in audit mode: deploy data and extension rules as audit only for two weeks to a pilot ring; review false positives with users before enforcing.
- Seed test cases: install a test extension requesting broad host permissions, upload a document with a test classifier match to an unsanctioned application, paste test data into a generative AI site, reuse a corporate test password on an external test site, and replay a test session cookie from another device. Record which are blocked, which are logged and how long events take to reach the SIEM.
- Test response and compatibility: disable an extension estate-wide, revoke a session, and run your top 20 business web applications, including any legacy ones, with accessibility tools.
- Roll back cleanly: remove force-installed extensions or the browser by policy, revert conditional access rules, confirm users regain access with the standard browser and obtain written confirmation that trial telemetry has been deleted.
Carry these measures into production: percentage of sessions to sensitive applications from the governed browser or profile, extensions installed outside the allowlist, median time for browser events to reach the SIEM, data rule false positive rate, Chromium patch lag in days, and password reuse alerts closed with a reset.
Standards and references
- NCSC: Device security guidance, Managing web browser security
- CISA: Capacity Enhancement Guide, Securing Web Browsers and Defending Against Malvertising
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- Google: Chrome Enterprise, Configure ExtensionSettings policy
- Google: Chrome log events
- Microsoft: Detailed guide to the ExtensionSettings policy for Microsoft Edge
- Microsoft: Data loss prevention in Edge for Business
- MITRE ATT&CK: T1176.001 Browser Extensions
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Enterprise Browser and Browser Security Guide · Browser Extension Security Guide · SASE and SSE Buyer's Guide · DLP Buyer's Guide · Infostealer Threat Guide