Push Security provides browser based identity threat detection and response. Its browser extension watches how employees actually log in to and use their work apps, then stops phishing, account takeover and session hijacking as they happen, fixes weak identity hygiene and controls shadow SaaS and AI tools.
It is for security and identity teams that need to see the logins their identity provider cannot, because the browser is now where most work, and most identity attacks, happen.
At A Glance
| Vendor | Push Security |
|---|---|
| Category | Browser based identity threat detection and identity security posture |
| Identities covered | Workforce user accounts, credentials, OAuth grants, agentic sessions |
| Deployment | Browser extension |
| Agentic AI | Agentic detection engine, AI tool and agent visibility |
| Certifications | SOC 2, ISO IEC 27001, ISO IEC 27701, Cyber Essentials |
| Funding | Series B led by Redpoint Ventures |
| Market classification | Identity Security Posture Management; also Workforce IAM |
What Push Security Does
An identity provider only sees the logins it manages. Employees also sign in to apps with passwords, social logins and accounts that never touch SSO, and attackers target exactly those gaps. Push shows how users really authenticate across every account, every authentication method and every shadow app, including ghost logins and breached credentials.
The product works at the rendered page level inside the browser, so it needs no traffic rerouting or TLS interception. One extension collects telemetry, enforces controls in real time and feeds an agentic detection engine, and it runs across every browser in the organisation with no migration to a separate enterprise browser.
Products
Identity Threat Detection
Security operations teams use this to stop attacks that target user identities in the browser. Phishing is detected by behaviour rather than by payload or delivery channel, which catches phishing kits and adversary-in-the-middle pages. Account takeover attempts, including token theft, are stopped before the account is lost, and session markers in the browser reveal stolen session tokens being replayed. Reused and compromised credentials are flagged across SaaS logins to blunt credential stuffing.
Identity Posture
Identity and IT teams get a view of the hygiene problems an attacker would exploit: missing MFA, password reuse, non-SSO logins, shadow apps and risky extensions. Ghost logins, the hidden login paths that bypass SSO, are surfaced, and malicious extensions can be detected and blocked. For each app Push shows whether access is through SSO (SAML or OIDC), password or social login, and whether MFA and a password manager are in use. Password pinning ties a password to its legitimate domain so it cannot be typed into another site.
Shadow SaaS, AI And Data Controls
For organisations losing track of the apps and AI tools staff adopt, Push controls shadow SaaS from the browser and shows real user activity inside AI tools, covering shadow AI apps, agent access and extensions. DLP is enforced at the point of interaction, as the user types, pastes or uploads.
How It Works
| Component | What it does |
|---|---|
| Browser extension | The extension supports Google Chrome, Microsoft Edge, Firefox, Safari, Brave, Opera, Arc and Island, plus agentic browsers such as Comet, Atlas and Dia, as well as BYOD devices without MDM and Chromebooks. |
| Deployment | Managed deployment via MDM, Google Admin Console or Microsoft Group Policy is recommended, with email enrolment and a self-enrolment landing page as alternatives. |
| Credential handling | Passwords are never stored and never leave the browser. The extension keeps a salted partial hash for later checks and tests passwords against breach lists using k-anonymised hashes from Have I Been Pwned. |
| Event export | Events reach SIEM and SOAR platforms such as Microsoft Sentinel through a REST API and signed JSON webhooks. |
| Detection updates | New detection rules produced by the agentic detection engine are deployed across all enrolled browsers. |
Identities And Systems Covered
| Workforce users | How employees log in to apps, including SSO, password and social logins. |
|---|---|
| Credentials | Reused and breached passwords, checked inside the browser. |
| MFA status | MFA registration per account. |
| Sessions and tokens | Session token theft and replay. |
| Third party access | OAuth grants to third party apps and risky browser extensions. |
| AI tools and agents | The AI tools employees and agents use, what data they share, and agentic sessions. |
Agentic AI Capabilities
Agentic Detection Engine
The detection engine is run by AI agents covering hypothesis development, threat hunting, autonomous analysis and autonomous detection engineering. They hunt for new attack techniques, then “write detection rules and deploy blocks” without waiting for a human analyst.
AI Usage Governance
Agents and agentic browsers are treated as users in their own right: Push sees which AI tools and agents are active, what data flows into them and which agentic browsers are in use, and applies the same controls as for human sessions.
Company Background
| Leadership | Adam Bateman, Co-Founder and CEO; the company was founded by former red team members. |
|---|---|
| Funding | A reported $30 million Series B led by Redpoint Ventures with Datadog Ventures and existing investors, bringing total funding to a reported $49 million. Other investors include Decibel, Google Ventures and B3 Capital. |
| Research | The Browser and Identity Attacks Matrix and a research blog. |
| Recognition | Award winner in the enterprise browser security category at The Hacker News Cybersecurity Stars Awards 2026. |
Note: This overview is compiled from Push Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.