'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Shadow AI: how to discover, govern, and secure AI apps
Blocking AI tools doesn't stop employees from using AI — it stops you seeing how they use it. The solution: make the governed path easier than the workaround.
// Read
Browser security
127 posts
Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.
How Push’s agentic threat hunting in the browser benefits every customer
Security outcomes you can achieve when AI agents hunt in the browser, identify new threats, and ship detections that benefit everyone.
Thought leadership
// Read
Crossing the AI security chasm with the SANS AI security maturity model
Most organizations know they have an AI security problem. A new SANS framework shows why so few are making progress - and what it actually takes to get unstuck.
Thought leadership
// Read
Why your training budget belongs in real-time browser security
Organizations spend billions annually on awareness training. Here's why browser-based technical controls can make the difference where training falls short.
Thought leadership
// Read
AI regulation is here: how browser visibility and control can achieve compliance
AI regulations across the US, EU, and UK are converging on obligations that most organizations can't meet without browser visibility into AI tool use.
Regulation & compliance
// Read
Your EDR is working exactly as intended. Attackers are getting around it anyway.
This article explains the gap between what EDR sees and what happens inside the browser, and what it takes to close it.
Thought leadership
// Read
Why you can't control AI without being in the browser
Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.
Thought leadership
// Read
No, you can’t just vibecode an AI-driven threat hunting pipeline
Push uses commercial AI models to deliver agentic threat hunting. Can’t you just build something yourself with those same models? Well, no.
Thought leadership
// Read
The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever
AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.
Thought leadership
// Read
How to make the business case for a browser security solution
Browser security is one of the fastest-growing investment areas in enterprise security. Here's our proven framework to create budget for browser security tools.
Thought leadership
// Read
Shadow AI: what Push data reveals about the scale of the problem
Push telemetry shows the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use. Here's what it means for security.
Thought leadership
// Read
What we learned from 'Security Theater vs. Security That Works' with Matt Johansen
What we learned from sitting down with Matt Johansen to discuss the difference between security theater and security that actually works.
Thought leadership
// Read
Enterprise browser vs. browser extension: Which should your security team choose?
If you're building a shortlist of browser security vendors, do you need a full-stack enterprise browser, or browser security extension?
Thought leadership
// Read
Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt
Here are 7 things we learned from our conversation with Troy Hunt on the "Yes, you've been pwned" webinar.
Thought leadership
// Read
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
7 things we learned from ‘Why the browser is the new battleground’ with John Hammond
Here are 7 things we learned from our conversation with John Hammond on the "Why the browser is the new battleground" webinar.
Thought leadership
// Read
Why "good enough" isn’t enough: the case for best-of-breed browser security
Why "good enough" isn’t enough when it comes to browser security, and a best-of-breed approach is needed to tackle emerging threats.
Thought leadership
// Read
The top 10 security problems you can solve in the browser — ranked by value
Ranking the security problems you can solve in the browser by security value and browser fit.
Thought leadership
// Read
7 things Omdia's latest report tells us about the secure enterprise browser market
Unpacking the latest research report from Omdia and what it means for the secure enterprise browser market.
Thought leadership
// Read
How to avoid the browser security buyer's trap
Securing the browser vs. securing the organization via the browser — what's the difference?
Thought leadership
// Read
Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline
How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.
Thought leadership
// Read
The CISO's data problem (and how browser telemetry can help)
How CISOs can use browser telemetry to support cyber risk quantification in areas where traditional data points fall short.
Thought leadership
// Read
Why relying on browser extension risk scoring is an antipattern that won’t predict your next breach
Why typical browser extension risk scores are poor predictors of which extensions will actually lead to a compromise.
Thought leadership
// Read
Unpacking the Vercel breach: A cautionary tale for Shadow AI and OAuth sprawl
In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.
Breach analysis
// Read
Browser sync attacks: Where personal account hacks lead to corporate breaches
Browser sync attacks result in business credentials being compromised via personal account and device breaches. Here's what you need to know.
Threat research
// Read
Guide: How to use Push controls to protect your users from modern browser threats
How to use in-browser controls to stop browser-based attacks before compromise can occur
Guide
// Read
Product release: March 2026
Here’s what’s new on the Push platform for March 2026.
Release notes
// Read
Guide: How to manage and block browser extensions using Push
How to detect risky and malicious extensions and block them from running in employee browsers.
Guide
// Read
Cyber Essentials April 2026 update: Mandatory MFA on ALL cloud services (and how Push can help)
Big changes are being made to the Cyber Essentials scheme in 2026 that will change how companies must validate compliance. Here’s what you need to know.
Regulation & compliance
// Read
Push + Cloud Security: What do you do when bad looks normal?
Why cloud security tools only give you part of the picture when it comes to modern attacks.
Thought leadership
// Read
Push + Endpoint Security: Extending detection and response to the browser
Why extending detection and response into the browser is crucial in the face of modern attacks that consciously evade the network and endpoint.
Thought leadership
// Read
Push + Network Security: The gap between seeing the packet and securing the session
Why network and web traffic only gives you part of the picture when it comes to modern browser-based attacks.
Thought leadership
// Read
Taking the fight to attackers: Push’s top features of 2025
Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.
Product feature
// Read
Product release: November 2025
Here’s what’s new on the Push platform for November 2025.
Release notes
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
Fixing SecOps alert fatigue with browser telemetry
How browser data can improve detection fidelity and reduce alert fatigue, enabling SecOps teams to save time and detect more attacks.
Thought leadership
// Read
How cyber breaches are driving tighter MFA requirements and enforcement
MFA regulators, insurers, and policy-makers are getting tighter on their MFA requirements, fuelled by public cyber breaches.
Regulation & compliance
// Read
Product release: September 2025
Here’s what’s new on the Push platform for September 2025.
Release notes
// Read
6 browser-based attacks every security team should be prepared for
What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.
Thought leadership
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks
We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows.
Product feature
// Read
How browser-level controls change the fight against phishing
Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.
Thought leadership
// Read
A simple, browser-based way to protect your help desk against social engineering
Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.
Product feature
// Read
Better together: Identity telemetry from Push + smart storage and searches from Cribl
We’re thrilled to announce our partnership with Cribl to make it much easier to snapshot, transform, and query Push telemetry.
Partnership
// Read
Navigating the 2025 HIPAA Security Rule changes: What you need to know (and how Push can help)
The HIPAA Security Rule is getting a long-overdue facelift in 2025. Here's our quick overview of the key changes and how Push can help you to be compliant.
Regulation & compliance
// Read
Introducing the Push Security Advisor Network (PSAN)
Introducing a new era of partner-first phishing protection and identity security.
Company news
// Read
Three reasons why browser is best for stopping phishing attacks
Why being in the browser gives defenders a key advantage over network and email phishing prevention, detection, and response tools.
Thought leadership
// Read
Why most phishing attacks feel like a zero-day
Most phishing attacks involve a phishing page that has never been seen before. When detection relies on known-bad, this makes every attack feel like a zero-day.
Thought leadership
// Read
Series B and Beyond: Securing the New Perimeter
I’m thrilled to share that Push Security has raised our Series B funding. This is a huge moment for us and our customers in the fight against identity attacks.
Company news
// Read
Introducing Push password enforcement — for when weak passwords are still plaguing you
Detects when employees have weak, reused, or stolen passwords and guide them to update their password using in-browser messaging on any app.
Product feature
// Read
6 breaches in 5 months: Why attackers are targeting Jira with stolen credentials
Attackers are persistently targeting Jira accounts with stolen credentials. What can we learn from this trend?
Breach analysis
// Read
Why it's time for phishing prevention to move beyond email
Modern MFA-bypass phishing attacks are routinely defeating primarily email-based security controls. Why are controls failing and what can we do about it?
Thought leadership
// Read
Product release: March 2025
Here’s what’s new on the Push platform for March 2025.
Release notes
// Read
Minimum Viable Identity Security
How app developers can go beyond Minimum Viable Secure Product (MVSP) to implement better identity protections and prevent identity-based attacks.
Thought leadership
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
No more hard simple problems: Enforce MFA on third-party apps with Push
Using Push to enforce MFA on third-party apps in the browser — even where MFA enforcement isn't supported by the app itself.
Product feature
// Read
How real-world attacks and research drove Push’s most popular features of 2024
How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities.
Product feature
// Read
Guide to secure browser extension deployment
How extension developers can improve their security controls to prevent extension compromise.
Guide
// Read
Product release: December 2024
Here’s what’s new on the Push platform for December 2024.
Release notes
// Read
Automating SSO password resets using Push
Using Push to automate password resets for your most critical identities when a password vulnerability is detected.
Product feature
// Read
River crossing: What you can accomplish in your first 90 days with Push Security
We’ve put together the following guide for intrepid security teams as they use Push to secure against modern identity attacks.
Guide
// Read
Eliminate false positives with verified stolen credential detections using Push
Push now compares user passwords with TI feeds to alert you when valid credentials are available on the clearweb and darkweb.
Product feature
// Read
Why I’m joining Push Security, from our new Chief Revenue Officer
Push's new Chief Revenue Officer, Kevin Arsenault, shares why he decided to join the Push team.
Company news
// Read
How AitM phishing kits evade detection: Part 2
How attackers are breaking detection signatures designed to identify phishing sites impersonating real login pages.
Threat research
// Read
Product release: November 2024
Here’s what’s new on the Push platform for November 2024.
Release notes
// Read
Don’t let attackers find the keys to your kingdom in a personal password manager
Make sure sensitive corporate credentials don’t leave your corporate environment and end up in personal password managers with Push.
Product feature
// Read
Shifting detection left for more effective threat detection
Why relying on post-compromise detection and response is no longer an option for modern browser-based attacks.
Thought leadership
// Read
Detecting and blocking phishing attacks in the browser
How Push detects and blocks phishing attempts in the browser – explained in less than two minutes.
Product feature
// Read
How many vulnerable identities do you have?
Using Push data to calculate how many vulnerable identities the average organization has, and how they lead to different methods of account takeover.
Threat research
// Read
Hackers don’t hack in, they log in: How to prevent account takeover with Push
How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts.
Product feature
// Read
Adding cloned login page detection to your phishing defense arsenal
We've added cloned login page detection, providing yet another layer of protection against phishing attacks.
Product feature
// Read
Our design philosophy: Detecting what matters
This is the first blog in a short series we’re putting together about the ‘why’ behind the ‘what’ at Push. This entry is focused on threat detection.
Thought leadership
// Read
Push introduces support for Arc browser, securing users wherever they work
We're adding support for Arc, an increasingly popular browser with developers and engineers.
Release notes
// Read
How AitM phishing kits evade detection
Taking a closer look at the steps that AitM phishing kits take to hide from the prying eyes of security teams and threat intelligence vendors.
Threat research
// Read
5 reasons why Push Security shouldn’t exist
Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.
Thought leadership
// Read
Introducing set-and-forget controls that stop real-world identity attacks
Enable detections and interventions in the browser using Push’s new security controls.
Product feature
// Read
Combining the powers of Push and Panther to stop identity attacks
Push is excited to partner with Panther, bringing our unique browser telemetry to your SIEM.
Partnership
// Read
Introducing session token theft detection: Why browser is best
Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.
Product feature
// Read
Investigating and responding to a third-party data breach using Push
How to use Push to investigate and respond to a third-party data breach, which results in credentials being stolen and sold on criminal marketplaces.
Guide
// Read
The web proxy is dead… long live the browser extension!
Right now the majority of detections for identity attacks rely on web proxy telemetry. Here’s why the browser can be a better alternative.
Thought leadership
// Read
Introducing AitM phishing toolkit detection, powered by the Push browser agent
Push analyzes behavioral attributes of malware to identify phishing tools like Evilginx and NakedPages and immediately block end-users from visiting them.
Product feature
// Read
Enforce end-user security controls with our new app banner options
Use Push's variety of app banner options to control which cloud apps employees use, and how they use them.
Product feature
// Read
Dev diary: Phishing prevention behind the scenes
Behind the scenes of our approach to designing and developing our latest feature, SSO password protection.
Product feature
// Read
Introducing SSO Password Protection: Stop employees’ IdP credentials being exposed or phished
Use the Push browser agent’s unique vantage point to protect SSO credentials by blocking employees from entering their password into any other site.
Product feature
// Read
Product release: April 2024
Here’s what’s new on the Push platform for April 2024.
Release notes
// Read
A year of building: Top features we shipped this year
Some highlights of what we've built over the last year on our mission of stopping identity attacks.
Company news
// Read
5 ways to defeat identity-based attacks
In this blog post we will cover what identities are, how we secure perimeters in general, and and how this maps to the identity space.
Thought leadership
// Read
Product release: February 2024
Here’s what’s new on the Push platform for February 2024.
Release notes
// Read
Introducing in-browser app banners: Set guardrails for cloud apps
Don’t leave it up to your employees to figure out how to use cloud apps securely. Guide them directly in their browsers when they access their apps.
Product feature
// Read
Phishing Microsoft Teams for initial access
In this article, we will cover a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams.
Threat research
// Read
Product release: January 2024
Here’s what’s new on the Push platform for January 2024.
Release notes
// Read
What is SAML SSO?
In this article, we'll explain what SAML SSO is, how it works, and clarify some common misconceptions.
Guide
// Read
Abusing Okta's SWA authentication
We'll cover the implications of using Okta's SWA authentication method. Learn what security teams need to know in an account breach and IR scenario.
Threat research
// Read
Product release: November 2023
Here’s what’s new on the Push platform for November 2023.
Release notes
// Read
Understanding Third-Party Risk Management (TPRM): how to protect your organization
In this article, we define third-party risk management and explore additional approaches that can help manage third-party risk.
Guide
// Read
6 ways to manage third-party access to your data with Push
Employees are self-adopting SaaS apps and creating new cloud identities without IT approval. Learn how to manage which third parties have access to your data.
Product feature
// Read
6 surprising takeaways from a recent report on identity-based attacks
A new report on securing digital identities has some interesting takeaways to consider as we think about securing identities in the cloud. Here's our take.
Thought leadership
// Read
Product release: September 2023
Here’s what’s new on the Push platform for September 2023.
Release notes
// Read
Credential stuffing: The most common attack against SaaS identities
Credential stuffing attacks are incredibly common, but they often go undetected. These attacks are often the entry point for attack. Learn how to prevent them.
Guide
// Read
Get out of the dark: Manage the risk of shadow identities
Employees sign up to cloud apps on their own every day. Each time, they create a new account and a new identity on that app. How do you find and secure them?
Guide
// Read
Understanding Shadow IT and Shadow SaaS: Definition, security risks, and how to manage it
We’ll define shadow IT, talk through the security risks associated with it and give some actionable guidance on how to manage it.
Guide
// Read
Focus on account and identity security to reduce SaaS risks
You’ve probably locked down the known cloud services your company is using, but what about all those other SaaS apps people in the company are using?
Guide
// Read
SaaS Security: what is it & how to manage the risk
We'll quickly define SaaS security and help you better understand how to manage the risk SaaS applications introduce to your business
Guide
// Read
Free and trial SaaS applications are even riskier than paid apps
Free and trial SaaS accounts are often invisible to security teams and still interact with real, live corporate data.
Thought leadership
// Read
The no-jargon guide to solving shadow SaaS
Adapt your thinking to secure your data. Security needs to move from being the Department of No to the Department of Yes, Unless...
Guide
// Read
7 Steps to secure your data across shadow SaaS apps
Attackers commonly target SaaS apps because they know employees sign up without running them past IT first. Learn how to adjust to secure your data.
Guide
// Read
SaaS sprawl isn't a problem - if you completely change your approach
Employees using a new work app used to be the final step of the software-onboarding process. Now it's the first. Security must adapt to secure business data.
Thought leadership
// Read
Want to discover the full extent of your SaaS sprawl? Embrace browser extensions
Browser extensions are the most effective SaaS discovery tool because they can capture employee SaaS use and adoption in real time, as employees sign up.
Thought leadership
// Read
Push it real good: Why I’m excited to join Push’s board
SaaS sprawl is not just a raw increase of apps in-use, but also due to employees self-adopting new apps. Orgs need sensible guardrails for employees.
Company news
// Read
From launch to series A
We’re proud to announce our $15M Series A round, led by GV. Here's what we've learned about what our customers need since we launched in July 2022.
Company news
// Read
Product Release: March 2023
Here’s what’s new on the Push platform for March 2023.
Release notes
// Read
Product Release: December 2022
Here’s what’s new on the Push platform for December 2022.
Release notes
// Read
Product release: August 2022
Here’s what’s new on the Push platform for August 2022.
Release notes
// Read
How to discover SaaS use without invading employee privacy
Learn how to manage SaaS in a way that keeps employees productive and doesn't compromise privacy.
Thought leadership
// Read
How to find the right SaaS security solution for your organization
In this guide, we’ll break down some major SaaS use cases and match them up with solutions that can address them, covering pros and cons for each.
Guide
// Read
What we’ve been up to with our seed funding: a peek behind the curtain
Yesterday, we announced our official launch and what Push Security is all about following our $4m series seed.
Company news
// Read
Building a culture of trust to secure SaaS, together
We’re excited to announce our $4M seed round, led by Decibel. See how we’re building tech that allows companies to let employees freely & securely adopt SaaS.
Company news
// Read
Push Security Announces $4M Seed Round to Introduce User-Centric Approach to Securing SaaS
Launches solution that finds SaaS apps employees are using and guides them to fix issues
Company news
// Read
How to roll-your-own SaaS discovery
We’ve compiled some methods for discovering SaaS. Lets explore each approach and learn new ways to discover unknown SaaS, capture SaaS use, and secure it.
Guide
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.