Surf Security (SURF) is an endpoint browser-SASE company that secures work at the browser on the user’s own device. It is built for organisations that need to give employees, contractors, BYOD staff and newly acquired teams safe access to company applications and data without routing traffic through a proxy or virtual desktop.
The problem it addresses is that the browser has become the place where people, data and applications meet, yet many organisations still secure it from a distance. SURF moves those controls onto the endpoint, and extends them to autonomous AI agents that work in the browser too.
At A Glance
| Vendor | Surf Security (SURF) |
|---|---|
| Category | Enterprise browser, browser-SASE |
| Identities covered | Employees, contractors, BYOD staff, acquired teams, autonomous AI agents |
| Deployment | Full browser on Windows, macOS, Linux and ChromeOS; extension for Chromium browsers; mobile on iOS, iPadOS and Android |
| Agentic AI | Sandboxed, human-verified runtime for autonomous agents |
| Customers | Tanium, Ericsson, Vodafone, PIB Group, Check Point |
| Market classification | Network Security; also Endpoint Security |
What Surf Security Does
Contractors, BYOD staff and newly acquired teams often work from devices the company does not manage, and proxies or virtual desktops are slow and costly ways to reach them. Instead of sending traffic elsewhere for inspection, SURF runs its Zero Trust controls on the device where the work happens.
The same controls are delivered either as a full browser or as an extension to the one people already use, so an organisation can pick the form that suits each group of users. Policies, identity checks and logging stay the same whichever form is used, and the approach applies equally to staff working with generative AI tools.
Products
Zero Trust Browser And Zero Trust Extension
The Zero Trust Browser is a full Chromium-based browser that replaces or sits alongside Chrome, Edge or Safari. It suits organisations that want complete control of the browsing environment on managed and unmanaged devices. Administrators can switch copy, paste, printing and other functions on or off. For teams that want to keep the browser people already use, the Zero Trust Extension adds the same enterprise controls to Chrome, Edge and other Chromium browsers.
- Encryption, watermarking, secured storage and malware scanning for downloaded files
- Role-based permissions and device posture checks covering antivirus, disk encryption, OS version, certificates and extensions
- Anti-phishing checks including trusted domains, reputation checks and SSL certificate verification
- Transactional MFA and control over add-ons, extensions, web filtering and content rendering
Shadow AI And Generative AI Security
Staff often paste sensitive data into AI tools that the security team has never approved. SURF discovers every AI tool in use on managed and unmanaged devices, masks PII and secrets in prompts, blocks risky uploads and governs AI browser extensions, using contextual detection to stop sensitive data reaching unauthorised tools.
How It Works
- Endpoint enforcement. SURF deploys without VDI or a proxy, and its controls run on the endpoint itself.
- Platforms. The full browser is built on Chromium and runs on Windows, macOS, Linux and ChromeOS. The extension runs inside Chrome, Edge and other Chromium browsers, and a mobile version covers iOS, iPadOS and Android, so the same policies follow users across desktop and mobile devices.
- Rollout. Deployment uses existing MDM or self-install.
- Access. Users reach company assets on premises or in the cloud through the browser, with access scoped per application.
Identities And Systems Covered
| Workforce users | Per-app access for employees, contractors, BYOD staff and acquired teams |
|---|---|
| Identity binding | Access scoped to the user’s identity and enforced in the browser |
| Devices | Posture checks on managed and unmanaged endpoints across desktop and mobile operating systems |
| AI agents | Autonomous agents running inside a sandboxed SURF Browser runtime with approval gates |
| Secrets in prompts | PII and secrets typed into generative AI tools |
Agentic AI Capabilities
Agent Runtime
SURF gives autonomous agents a sandboxed, human-verified runtime. Each workflow runs in a sandboxed browser environment, on premises or in the cloud, with auto-correction feedback.
Boundaries And Approval
Agents work within strict boundaries, and prompt injection and unauthorised actions are blocked. Steps that need verification pause for approval, so agents never take irreversible actions without sign-off. Automation blueprints are reviewed by a person before they run, and the planning phase has no live access.
Audit
Every execution produces structured logs, video recordings and an outcome report. Execution transcripts record navigation, clicks and timestamps and can be exported as Playwright scripts or JSON.
Integrations
| Area | Integrations |
|---|---|
| Identity | Okta, Microsoft Entra |
| SIEM and observability | Splunk, Elastic, Datadog |
| Threat intelligence and file scanning | VirusTotal, MetaDefender |
| Secrets and infrastructure | HashiCorp |
| Device management | Kandji |
Company Background
| Founded | 2022, in London, United Kingdom |
|---|---|
| Leadership | Moty Jacob (CEO) |
| Funding | Backed by cybersecurity investors |
Note: This overview is compiled from Surf Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.