[{"data":1,"prerenderedAt":1083},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":35,"trust-badges":98,"solution-nav":119,"mega-nav":264,"fa-icon-solid-faDisplay":419,"fa-icon-solid-faFilter":422,"fa-icon-solid-faCloudArrowUp":424,"fa-icon-solid-faEnvelope":427,"fa-icon-sharp-regular-faUserSecret":429,"fa-icon-sharp-regular-faBrainCircuit":432,"fa-icon-sharp-regular-faShieldCheck":434,"fa-icon-sharp-regular-faRadar":436,"fa-icon-solid-faMobileScreenButton":438,"fa-icon-sharp-regular-faSatelliteDish":441,"fa-icon-brands-faChrome":443,"fa-icon-sharp-regular-faPenNib":445,"fa-icon-sharp-regular-faBooks":447,"fa-icon-sharp-regular-faBriefcase":449,"fa-icon-sharp-regular-faBookOpenCover":451,"fa-icon-sharp-regular-faBrowser":453,"fa-icon-sharp-regular-faBook":455,"fa-icon-sharp-regular-faGrid":457,"fa-icon-sharp-regular-faBuilding":459,"fa-icon-sharp-regular-faHandshakeSimple":461,"fa-icon-sharp-regular-faArrowTrendUp":463,"fa-icon-sharp-regular-faCalendarStar":465,"fa-icon-sharp-regular-faNewspaper":467,"fa-icon-sharp-regular-faUsers":469,"fa-icon-sharp-regular-faMessagesQuestion":471,"browser-security-buyers-guide":473,"bypassing-controls":954,"builder-image-sizes-45h":1082},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":20,"data":21,"variations":26,"lastUpdated":27,"firstPublished":28,"testRatio":29,"createdBy":30,"lastUpdatedBy":31,"folders":32,"lastUpdateSource":33,"stageModifiedSincePublish":6,"rev":34},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},768,640,320,"data",[],{"link":22,"text":23,"type":24,"url":25},{},"Get the latest stats and analysis on browser-based attacks","web-banner","https:\u002F\u002Fpushsecurity.com\u002Fresources\u002Fbrowser-attacks",{},1790775413052,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],null,"v9c05zm0mil",{"createdBy":36,"createdDate":37,"data":38,"folders":86,"id":87,"lastUpdated":88,"lastUpdatedBy":36,"meta":89,"modelId":92,"name":93,"published":13,"query":94,"testRatio":29,"variations":95,"firstPublished":96,"stageModifiedSincePublish":6,"lastUpdateSource":33,"rev":97},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":39,"inputs":40,"text":41,"url":42,"blocks":43,"state":82},"ewrererw",[],"testrfesssssssssss","",[44,71],{"@type":45,"@version":46,"id":47,"component":48,"responsiveStyles":61},"@builder.io\u002Fsdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":49,"tag":49,"options":50,"isRSC":33},"TopBannerContent",{"text":51,"ctaText":52,"url":53,"mainText":54,"cta":57,"styleVariant":60,"showMonsters":6},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https:\u002F\u002Fpushsecurity.com\u002Fwebinar\u002Fstate-of-browser-security",{"content":55,"fontSize":56},"\u003Cp class=\"\">\u003Cstrong>Get a free browser security assessment and find what your current tools miss\u003C\u002Fstrong>\u003C\u002Fp>","text-base",{"content":58,"fontSize":56,"url":59},"\u003Cp class=\"\">Request Assessment\u003C\u002Fp>","https:\u002F\u002Fpushsecurity.com\u002Flp\u002Fbrowser-security-assessment","default",{"large":62},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67,"marginTop":68,"marginBottom":68,"fontSize":69,"fontWeight":70},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"id":72,"@type":45,"tagName":73,"properties":74,"responsiveStyles":77},"builder-pixel-6kql2jrn2g9","img",{"src":75,"aria-hidden":76,"alt":42,"width":66,"height":66},"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fpixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true",{"large":78},{"height":66,"width":66,"display":79,"opacity":66,"overflow":80,"pointerEvents":81},"block","hidden","none",{"deviceSize":83,"location":84},"large",{"path":42,"query":85},{},[],"fd266d0172cc47429be7ad10f48c99ad",1792492581845,{"breakpoints":90,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":91},{"medium":16,"small":17,"xsmall":18},"component","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"dezl7amuk0b",[99,103,107,111,115],{"title":100,"logo":101,"createdDate":102},"SOC2","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":104,"logo":105,"createdDate":106},"GDPR","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":108,"logo":109,"createdDate":110},"Cyber essentials","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":112,"logo":113,"createdDate":114},"ISO IEC 27001","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":116,"logo":117,"createdDate":118},"ISO IEC 27701","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[120,189,234],{"id":121,"label":122,"text":42,"navIcon":123,"items":124},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[125,130,135,140,145,150,155,160,165,169,174,179,184],{"title":126,"text":127,"url":128,"navIcon":129},"Phishing","Detect phishing behaviorally in the browser, regardless of the payload or delivery channel.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fzero-day-phishing","sharp-regular:faFishingRod",{"title":131,"text":132,"url":133,"navIcon":134},"Adversary-in-the-Middle","Detect and block MFA-bypassing AiTM phishing pages in real-time.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fadversary-in-the-middle-attacks","solid:faUserSecret",{"title":136,"text":137,"url":138,"navIcon":139},"ClickFix (and variants)","Intercept malicious copy and paste attacks at the point of interaction.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fclickfix-fix-variants","sharp-regular:faLaptopCode",{"title":141,"text":142,"url":143,"navIcon":144},"Device code phishing","Detect and block device code phishing kits designed to get around passkeys.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fdevice-code-phishing","solid:faTabletScreenButton",{"title":146,"text":147,"url":148,"navIcon":149},"Consent phishing","Detect and block malicious OAuth consent grants before access is authorized.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fconsent-phishing","solid:faThumbsUp",{"title":151,"text":152,"url":153,"navIcon":154},"Malicious OAuth integrations","Detect and block the root cause of SaaS supply chain attacks.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-oauth-integrations","solid:faPlugCircleXmark",{"title":156,"text":157,"url":158,"navIcon":159},"Malicious browser extensions","Inventory, monitor, and block risky browser extensions.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":161,"text":162,"url":163,"navIcon":164},"Malicious file downloads","Control which files users can download by type, source, and user group.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmalicious-file-downloads","solid:faFileCircleXmark",{"title":166,"text":167,"url":168,"navIcon":164},"Infostealers","Detect infostealer delivery and respond to a compromise.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Finfostealer-malware",{"title":170,"text":171,"url":172,"navIcon":173},"Ghost logins","Surface hidden login paths that bypass SSO and expose accounts.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fghost-logins","solid:faGhost",{"title":175,"text":176,"url":177,"navIcon":178},"Mobile phishing (QR & SMS)","Detect phishing regardless of whether it arrives via email, SMS, or QR code.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fmobile-phishing-qr-code-sms","solid:faQrcode",{"title":180,"text":181,"url":182,"navIcon":183},"Credential stuffing","Identify reused and compromised credentials across SaaS logins.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fcredential-stuffing","custom:credentialStuffing",{"title":185,"text":186,"url":187,"navIcon":188},"Session hijacking","Detect and respond to stolen session token replay with browser session markers.","\u002Fsolution\u002Fstop-browser-based-attacks\u002Fsession-hijacking","solid:faCookieBite",{"id":190,"label":191,"text":42,"navIcon":192,"items":193},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[194,199,204,209,214,219,224,229],{"title":195,"text":196,"url":197,"navIcon":198},"Stop account takeover","Stop ATO before it happens, in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fstop-account-takeover","sharp-regular:faUserSecret",{"title":200,"text":201,"url":202,"navIcon":203},"Harden unmanaged identities","Identify gaps and harden them with guardrails","\u002Fsolution\u002Fachieve-security-outcomes\u002Fharden-unmanaged-identities","sharp-regular:faRadar",{"title":205,"text":206,"url":207,"navIcon":208},"Investigate browser-related incidents","Investigate and respond with browser telemetry","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":210,"text":211,"url":212,"navIcon":213},"Secure shadow IT","See and control shadow SaaS in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-shadow-saas","sharp-regular:faShieldCheck",{"title":215,"text":216,"url":217,"navIcon":218},"Secure AI","See and control AI apps in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-ai","sharp-regular:faBrainCircuit",{"title":220,"text":221,"url":222,"navIcon":223},"Secure BYOD","Extend security to unmanaged devices without MDM","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-bring-your-own-device","solid:faMobileScreenButton",{"title":225,"text":226,"url":227,"navIcon":228},"Secure Chromebooks","Protect Chromebooks against in-browser attacks","\u002Fsolution\u002Fachieve-security-outcomes\u002Fsecure-chromebooks","brands:faChrome",{"title":230,"text":231,"url":232,"navIcon":233},"Data loss prevention","Enforce DLP at the point of interaction in the browser","\u002Fsolution\u002Fachieve-security-outcomes\u002Finvestigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":235,"label":236,"text":42,"navIcon":237,"items":238},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[239,244,249,254,259],{"title":240,"text":241,"url":242,"navIcon":243},"Email Security","Stop phishing outside of the inbox.","\u002Fsolution\u002Ftool-replacements\u002Femail-security","faEnvelope",{"title":245,"text":246,"url":247,"navIcon":248},"Remote browser isolation","Detect attacks that happen inside the browser session.","\u002Fsolution\u002Ftool-replacements\u002Fremote-browser-isolation","solid:faDisplay",{"title":250,"text":251,"url":252,"navIcon":253},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","\u002Fsolution\u002Ftool-replacements\u002Fsecure-web-gateways","solid:faFilter",{"title":255,"text":256,"url":257,"navIcon":258},"CASB alternative","Catch browser-based identity threats in real time, not after the fact.","\u002Fsolution\u002Ftool-replacements\u002Fcloud-access-security-broker","solid:faCloudArrowUp",{"title":260,"text":261,"url":262,"navIcon":263},"Security awareness training","Block real phishing instead of training users on simulations.","\u002Fsolution\u002Ftool-replacements\u002Fsecurity-awareness-training","custom:securityAwareness",[265,293,354],{"id":266,"columns":267},"Solution",[268,283],{"kind":269,"heading":270,"span":29,"links":271},"links","Compare Push",[272,275,277,279,281],{"title":273,"url":247,"text":246,"navIcon":248,"variant":274},"vs Remote Browser Isolation","compact",{"title":276,"url":252,"text":251,"navIcon":253,"variant":274},"vs Secure Web Gateways",{"title":278,"url":257,"text":256,"navIcon":258,"variant":274},"vs Cloud Access Security Broker",{"title":280,"url":262,"text":261,"navIcon":263,"variant":274},"vs Security Awareness Training",{"title":282,"url":242,"text":241,"navIcon":243,"variant":274},"+ Email Security",{"kind":269,"heading":266,"span":46,"links":284},[285,286,287,288,289,290,291,292],{"title":195,"url":197,"text":196,"navIcon":198},{"title":215,"url":217,"text":216,"navIcon":218},{"title":230,"url":232,"text":231,"navIcon":233},{"title":210,"url":212,"text":211,"navIcon":213},{"title":200,"url":202,"text":201,"navIcon":203},{"title":220,"url":222,"text":221,"navIcon":223},{"title":205,"url":207,"text":206,"navIcon":208},{"title":225,"url":227,"text":226,"navIcon":228},{"id":294,"columns":295},"resources",[296,321,339],{"kind":269,"heading":297,"span":29,"links":298},"Resources",[299,306,311,316],{"title":300,"url":301,"text":302,"navIcon":303,"variant":304,"badge":305},"Research blog","\u002Fblog","Latest threat research and insights","sharp-regular:faPenNib","featured","Latest",{"title":307,"url":308,"text":309,"navIcon":310},"Resource library","\u002Fresources","Check out our webinars and downloads","sharp-regular:faBooks",{"title":312,"url":313,"text":314,"navIcon":315},"Customer stories","\u002Fcustomer-stories","What customers love about Push","sharp-regular:faBriefcase",{"title":317,"url":318,"text":319,"navIcon":320},"Help center","\u002Fhelp\u002Faudience\u002Fadministrators","Guides for employees and admins","sharp-regular:faBookOpenCover",{"kind":269,"heading":322,"span":29,"links":323},"Learn",[324,329,334],{"title":325,"url":326,"text":327,"navIcon":328},"Browser attacks in 2026","\u002Fresources\u002Fbrowser-attacks","The latest stats & analysis","sharp-regular:faBrowser",{"title":330,"url":331,"text":332,"navIcon":333},"Browser attacks glossary","\u002Fresources\u002Fbrowser-attacks-glossary","Understand the threat landscape","sharp-regular:faBook",{"title":335,"url":336,"text":337,"navIcon":338},"Browser attacks matrix","\u002Fresources\u002Fbrowser-identity-attacks-matrix","MITRE-inspired resource for red & blue teams","sharp-regular:faGrid",{"kind":294,"heading":340,"cards":341},"Latest resources",[342,348],{"title":343,"description":344,"cta":345,"background":347},"Browser-based attacks: the 2026 threat landscape","Half of attacks now reach victims outside of email. ClickFix is now the dominant browser attack technique. Get the latest stats and analysis from the Push Security team.",{"text":346,"url":326},"Read the report","orange",{"title":349,"description":350,"cta":351,"background":353},"The browser & identity attacks matrix","Check out the MITRE-inspired matrix of browser & identity attack techniques for red and blue teams. Get involved on GitHub.",{"text":352,"url":336},"Explore the matrix","black",{"id":355,"columns":356},"About",[357,375,398],{"kind":269,"heading":358,"span":29,"links":359},"Get to know us",[360,365,370],{"title":361,"url":362,"text":363,"navIcon":364},"About us","\u002Fabout","Meet the team and learn what drives us","sharp-regular:faBuilding",{"title":366,"url":367,"text":368,"navIcon":369},"Partners","\u002Fpartner","Become a partner and access resources","sharp-regular:faHandshakeSimple",{"title":371,"url":372,"text":373,"navIcon":374},"Investors","\u002Fabout#investors","Learn more about our investors and advisors","sharp-regular:faArrowTrendUp",{"kind":269,"heading":376,"span":29,"links":377},"Keep up with us",[378,383,388,393],{"title":379,"url":380,"text":381,"navIcon":382},"Events","\u002Fevents","See upcoming webinars and in-person events","sharp-regular:faCalendarStar",{"title":384,"url":385,"text":386,"navIcon":387},"News","\u002Fnews","Stay up to date on company news","sharp-regular:faNewspaper",{"title":389,"url":390,"text":391,"navIcon":392},"Careers","\u002Fcareers","Explore open roles","sharp-regular:faUsers",{"title":394,"url":395,"text":396,"navIcon":397},"Contact us","\u002Fcontact","Have a question? We're here to help","sharp-regular:faMessagesQuestion",{"kind":399,"heading":400,"testimonials":401},"testimonials","What customers say",[402,409,414],{"quote":403,"author":404,"jobTitle":405,"image":406,"url":313,"ctaText":407,"background":408},"Security is only as good as its weakest link. From day one, Push found the gaps that would allow attackers to circumvent our controls. We use Push every day — they're one of my favourite teams to work with.","Jason Waits","\u003Cp>CISO, Inductive Automation\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07","Read the customer story","white",{"quote":410,"author":411,"jobTitle":412,"image":413,"url":313,"ctaText":407,"background":408},"I'm not going to be able to shove a browser on everybody. I need to be able to support them where they are. Push gave us the visibility and control we needed while allowing people to choose their paths.","Myke Lyons","\u003Cp>CISO, Cribl\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F61920ec05c7a45b4b2259b8dded43c9b",{"quote":415,"author":416,"jobTitle":417,"image":418,"url":313,"ctaText":407,"background":408},"No matter the channel for phishing — email, LinkedIn, text — the employee clicks a link that opens a browser session. We see the main control point moving from the endpoint to the browser.","Ash Devata","\u003Cp>CEO, GreyNoise\u003C\u002Fp>","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F392c75ae282342008130cf1147c20e82",{"w":420,"h":420,"d":421},512,"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":420,"h":420,"d":423},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":425,"h":420,"d":426},576,"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",{"w":420,"h":420,"d":428},"M48 64c-26.5 0-48 21.5-48 48 0 15.1 7.1 29.3 19.2 38.4l208 156c17.1 12.8 40.5 12.8 57.6 0l208-156c12.1-9.1 19.2-23.3 19.2-38.4 0-26.5-21.5-48-48-48L48 64zM0 196L0 384c0 35.3 28.7 64 64 64l384 0c35.3 0 64-28.7 64-64l0-188-198.4 148.8c-34.1 25.6-81.1 25.6-115.2 0L0 196z",{"w":430,"h":420,"d":431},448,"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":420,"h":420,"d":433},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":420,"h":420,"d":435},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":420,"h":420,"d":437},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":439,"h":420,"d":440},384,"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":420,"h":420,"d":442},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":420,"h":420,"d":444},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":425,"h":420,"d":446},"M406.1 198.1l0 0-3.6 10.7-56.3 168.8-221.5 69.9 98.5-98.5c5.2 1.9 10.8 3 16.7 3 26.5 0 48-21.5 48-48s-21.5-48-48-48-48 21.5-48 48c0 5.9 1.1 11.5 3 16.7l-98.5 98.5 69.9-221.5 168.8-56.3 10.8-3.6 0 0 60.1 60.1zM80 512l304-96 64-192c59.4-59.4 96.7-96.7 112-112-18.3-18.3-49.6-49.6-94.1-94.1L432-16C416.7-.7 379.4 36.6 320 96l-192 64-96 304 48 48z",{"w":425,"h":420,"d":448},"M404.8 45.3l12.4 46.4-77.3 20.7-12.4-46.4 77.3-20.7zm5.5 329.8l-58-216.4 77.3-20.7 58 216.4-77.3 20.7zm12.4 46.4l77.3-20.7 12.4 46.4-77.3 20.7-12.4-46.4zM315.1 19.6l-46.4 12.4 8.6 32-69.2 0 0-64-176 0 0 512 304 0 0-228.4c41.8 156.2 63.5 237.1 65.1 243 64.4-17.3 167.4-44.9 170-45.6l-12.4-46.4-107.7-401.8-12.4-46.4C413-6.6 371.7 4.4 315.1 19.6zM208.1 464l0-352 80 0 0 352-80 0zm-48-400l0 32-80 0 0-48 80 0 0 16zm0 80l0 224-80 0 0-224 80 0zm0 272l0 48-80 0 0-48 80 0z",{"w":420,"h":420,"d":450},"M168 0l-24 0 0 96-144 0 0 384 512 0 0-384-144 0 0-96-200 0zM464 256l-416 0 0-112 416 0 0 112zM320 304l144 0 0 128-416 0 0-128 144 0 0 48 128 0 0-48zm0-208l-128 0 0-48 128 0 0 48z",{"w":425,"h":420,"d":452},"M312 114.4l0 282.1 9.2-3.3C367.8 376.5 417 368 466.5 368l61.5 0 0-288-61.5 0c-38.5 0-76.7 6.6-113 19.6L312 114.4zM264 396.5l0-282.1-41.5-14.8C186.2 86.6 148 80 109.5 80l-61.5 0 0 288 61.5 0c49.5 0 98.7 8.5 145.3 25.2l9.2 3.3zM528 32l48 0 0 384-109.5 0c-44 0-87.7 7.6-129.2 22.4L288 456 238.6 438.4C197.2 423.6 153.5 416 109.5 416L0 416 0 32 109.5 32c44 0 87.7 7.6 129.2 22.4L288 72 337.4 54.4C378.8 39.6 422.5 32 466.5 32L528 32zM0 464l91.7 0c36.9 0 73.6 5 109.2 14.9l86.2 24 42.2-15.1c44-15.7 90.5-23.8 137.2-23.8l109.5 0 0 48-109.5 0c-41.3 0-82.2 7.1-121.1 21l-49.4 17.6-7.2 2.6-7.3-2-93.6-26c-31.4-8.7-63.8-13.1-96.4-13.1L0 512 0 464z",{"w":420,"h":420,"d":454},"M48 256l0 144 416 0 0-144-416 0zM0 64l512 0 0 384-512 0 0-384zm64 64l0 64 64 0 0-64-64 0zm120 8l-24 0 0 48 288 0 0-48-264 0z",{"w":430,"h":420,"d":456},"M24 0L0 0 0 432 .4 432c-.2 2.6-.4 5.3-.4 8l0 72 448 0 0-48-32 0 0-64 32 0 0-400-424 0zM368 400l0 64-320 0 0-24c0-22.1 17.9-40 40-40l280 0zM88 352c-14.4 0-28 3.5-40 9.6l0-313.6 352 0 0 304-312 0zm40-224l0 48 224 0 0-48-224 0zm224 96l-224 0 0 48 224 0 0-48z",{"w":420,"h":420,"d":458},"M112 64l0 48-48 0 0-48 48 0zM64 24l-40 0 0 128 128 0 0-128-88 0zm48 208l0 48-48 0 0-48 48 0zM64 192l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zM24 360l0 128 128 0 0-128-128 0zM280 64l0 48-48 0 0-48 48 0zM232 24l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zM400 64l48 0 0 48-48 0 0-48zM360 24l0 128 128 0 0-128-128 0zm88 208l0 48-48 0 0-48 48 0zm-48-40l-40 0 0 128 128 0 0-128-88 0zm0 208l48 0 0 48-48 0 0-48zm-40-40l0 128 128 0 0-128-128 0z",{"w":439,"h":420,"d":460},"M48 48l0 416 96 0 0-112 96 0 0 112 96 0 0-416-288 0zM0 0L384 0 384 512 0 512 0 0zM96 96l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0zM96 224l64 0 0 64-64 0 0-64zm192 0l0 64-64 0 0-64 64 0z",{"w":17,"h":420,"d":462},"M598.6 75.4L618 61.3 589.7 22.5C586 25.2 554.7 48 495.8 90.8l-34.1-22.7-6-4-145.2 0 0 0-144 0c-2.9 2.9-11.1 11.1-24.5 24.5-56.3-40.9-86.6-62.9-90.8-66.1L22.9 61.3c1.5 1.1 37.3 27.1 107.4 78.1l16.6 12.1c7.9-7.9 21.1-21.1 39.5-39.5l76.1 0-103 103-17 17c12.1 12.1 21.8 21.8 29.1 29.1 46.9 46.9 122.8 46.9 169.7 0L368.4 233.9 494.5 360c-16.7 16.7-29.4 29.4-38.1 38.1l-47-47-33.9 33.9 47 47-16 16-44.1 0-65-65-33.9 33.9 31 31-60.1 0-169-169-17-17-33.9 33.9 17 17 176 176 7 7 128 0 1 1 1-1 81.9 0 7-7c225.8-225.8 167.2-167.2 193-193l-33.9-33.9-64 64-143-143-17-17c-6.8 6.8-27.2 27.2-61.1 61.1-26.5 26.5-68.5 28-96.7 4.6l119.8-119.8 62.1 0 0 0 48.7 0c32.6 21.8 51.3 34.2 55.9 37.2l13.5-9.8 88-64z",{"w":425,"h":420,"d":464},"M352 96l224 0 0 224-48 0 0-142.1-191 191-17 17-17-17-111-111-139.8 139.8-17 17-33.9-33.9 17-17 156.8-156.8 17-17 17 17 111 111 174.1-174.1-142.1 0 0-48z",{"w":430,"h":420,"d":466},"M144 0l0 64 160 0 0-64 48 0 0 64 96 0 0 416-448 0 0-416 96 0 0-64 48 0zm0 112l-96 0 0 320 352 0 0-320-256 0zM261.6 228.2l84.1 12.2-60.9 59.3 14.4 83.8-75.2-39.6-75.2 39.6 14.4-83.8-60.9-59.3 84.1-12.2 37.6-76.2 37.6 76.2z",{"w":420,"h":420,"d":468},"M96 32l416 0 0 448-512 0 0-392 48 0 0 344 8 0c22.1 0 40-17.9 40-40L96 32zm38.4 400l329.6 0 0-352-320 0 0 312c0 14.4-3.5 28-9.6 40zM192 128l96 0 0 96-96 0 0-96zm152 48l72 0 0 48-96 0 0-48 24 0zM216 256l200 0 0 48-224 0 0-48 24 0zm0 80l200 0 0 48-224 0 0-48 24 0z",{"w":17,"h":420,"d":470},"M384 128a64 64 0 1 0 -128 0 64 64 0 1 0 128 0zm-176 0a112 112 0 1 1 224 0 112 112 0 1 1 -224 0zm252.8 76c5.9 2.6 12.4 4 19.2 4 26.5 0 48-21.5 48-48s-21.5-48-48-48l-.8 0c-1.6-16.6-5.8-32.4-12.1-47.1 4.2-.6 8.6-.9 12.9-.9 53 0 96 43 96 96s-43 96-96 96c-17.7 0-34.3-4.8-48.6-13.2 11.7-11.3 21.6-24.4 29.4-38.8zM208.6 242.8c-14.2 8.4-30.8 13.2-48.6 13.2-53 0-96-43-96-96s43-96 96-96c4.4 0 8.7 .3 12.9 .9-6.3 14.7-10.5 30.6-12.1 47.1l-.8 0c-26.5 0-48 21.5-48 48s21.5 48 48 48c6.8 0 13.3-1.4 19.2-4 7.8 14.4 17.7 27.5 29.4 38.8zM432 288l69.8 192-51.1 0-52.4-144-156.8 0-52.4 144-51.1 0 69.8-192 224 0zM151.2 304l-17.3 48-36.3 0-46.5 128-51.1 0 64-176 87.2 0zm354.8 48l-17.3-48 87.2 0 64 176-51.1 0-46.5-128-36.3 0z",{"w":425,"h":420,"d":472},"M144 354l-48 30 0-80-96 0 0-336 384 0 0 336-160 0-80 50zm0-56.6c43.5-27.2 65.6-41 66.2-41.4l125.8 0 0-240-288 0 0 240 96 0 0 41.4zM192 416l0-35.4 45.8-28.6 2.2 0 0 64 125.8 0c.6 .4 22.7 14.2 66.2 41.4l0-41.4 96 0 0-240-96 0 0-48 144 0 0 336-96 0 0 80-128-80-160 0 0-48zm0-340c-14.4 0-26.1 11.7-26.1 26.1l-40 0C125.9 65.6 155.5 36 192 36s66.1 29.6 66.1 66.1c0 29.7-17.7 46.9-33.3 55.6-4.5 2.5-8.9 4.8-12.9 6.2l-40 0 0-33.4c1.8-.2 3.6-.4 5.4-.6 9.7-1.1 19-2.1 27.9-7.1 7.5-4.2 12.9-10.1 12.9-20.8 0-14.4-11.7-26.1-26.1-26.1zM172 188l40 0 0 40-40 0 0-40z",{"createdBy":474,"createdDate":475,"data":476,"folders":938,"id":939,"lastUpdateSource":33,"lastUpdated":940,"lastUpdatedBy":31,"meta":941,"modelId":944,"name":481,"published":13,"query":945,"stageModifiedSincePublish":6,"testRatio":29,"variations":950,"firstPublished":951,"screenshot":952,"rev":953},"SfUPqW5tkibIPby49keNFMdHFTr1",1791462154043,{"inputs":477,"ogImage":478,"seoDescription":479,"seoTitle":480,"themeId":6,"title":481,"blocks":482,"url":934,"state":935},[],"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F22e347123cb1443ab877ea9f0c8a9f8b","A practical framework for evaluating browser security solutions: defining requirements, testing vendors, and building the business case","The buyer's guide to browser security","Browser Security Buyers Guide",[483,515,525,546,698,760,904,929],{"@type":45,"@version":46,"id":484,"component":485,"responsiveStyles":513},"builder-03af45c11d82499ab7a87859124bcbcf",{"name":486,"tag":486,"options":487,"isRSC":33},"BuyersGuideHero",{"title":488,"introText":489,"stats":490,"ctas":499},"\u003Cp>The \u003Cem>buyer’s guide\u003C\u002Fem>\u003Cbr \u002F>to browser security\u003C\u002Fp>\n","\u003Cp class=\"\">A practical framework for evaluating browser security solutions: defining requirements, testing vendors, and building the business case. \u003C\u002Fp>",[491,494,497],{"value":492,"description":493},"88%","Of organizations rank browser security a top-five priority",{"value":495,"description":496},"85%","Of employee working time spent in the browser",{"value":495,"description":498},"Expect to increase browser security spend in 12-24 months",[500,507],{"label":501,"url":502,"variant":503,"linkType":504,"file":505,"fileAction":506},"Download the guide","#download","primary","file","https:\u002F\u002Fcdn.builder.io\u002Fo\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F712ee43782e546fd86282bcea87d0009?alt=media&token=7cee14e6-ebee-4a20-935c-f2fb3672db9b&apiKey=f3a1111ff5be48cdbb123cd9f5795a05","open",{"label":508,"url":509,"variant":510,"linkType":511,"section":512},"Get browser security assessment","\u002Flp\u002Fbrowser-security-assessment","secondary","url","the-browser",{"large":514},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":516,"component":517,"responsiveStyles":523},"builder-dd2d4f7a6da9419897e4fa1fcf4a795d",{"name":518,"tag":518,"options":519,"isRSC":33},"BuyersGuideTheBrowser",{"title":520,"bodyText":521,"hint":522,"spacingBottom":83},"\u003Cp>The browser is where work happens, where attackers strike — and where your security stack can’t see\u003C\u002Fp>","\u003Cp class=\"\">Enterprise work has migrated into the browser, but security hasn’t followed. Attackers have had a lot of success by targeting the browser security gap in the security stack.\u003C\u002Fp>\u003Cp class=\"\">If you’re making the case for browser security in your organization, you’ve probably heard the objection: “We already have a SWG, EDR, email phishing tools, an IdP — can’t we solve this with what we have?” But modern attacks route past every one of them. Step through each control layer to see where its coverage ends.\u003C\u002Fp>","Click any control above to see how modern browser attacks get around it",{"large":524},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":526,"component":527,"responsiveStyles":544},"builder-5044920474834876b4457abf747e6009",{"name":528,"tag":528,"options":529,"isRSC":33},"BuyersGuideTwoArchitectures",{"title":530,"introText":531,"architectureA":532,"architectureB":538,"spacingBottom":83},"Two architectures, one category name","The market has converged on “Secure Enterprise Browsers” as a single category term, but it buckets together fundamentally different solutions serving different buyers with different problems.",{"tag":533,"title":534,"subtitle":535,"description":536,"visualLabel":537},"Architecture A","Browser extensions","Deploys into the browser & ready to use","Deploy into the browsers users already have without migration, retraining, or workflow changes. Collect telemetry from inside the browser session, detect malicious activity, and enforce controls. Gartner notes that extensions have become the preferred form factor, citing easier deployment, minimal training, and multi-browser compatibility, with extension-based offerings making up the majority of SEB vendors today.","Managed workspace",{"tag":539,"title":540,"subtitle":541,"description":542,"visualLabel":543},"Architecture B","Full-stack managed browsers","The whole browser is replaced","Replace the user's browser with a controlled workspace platform. Optimized for IT teams solving for access governance, device posture, VDI replacement, and policy enforcement. The Achilles heel is migration: adopting one means asking every user to switch away from Chrome, and Gartner notes most buyers start with a single use case and rarely pursue organization-wide deployment.","Managed Workspace",{"large":545},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":547,"component":548,"responsiveStyles":696},"builder-d39c3237ed634d97baee38013143f9d1",{"name":549,"tag":549,"options":550,"isRSC":33},"BuyersGuideSecurityValue",{"title":551,"introText":552,"whyItMattersLabel":553,"whyTheBrowserLabel":554,"tiers":555,"ctas":692,"ctaNote":695,"spacingBottom":83},"Security value × browser fit","Use cases ranked by risk reduction delivered and the browser’s unique suitability as the control point. Tier 1 use cases are uniquely solved in the browser.","Why it matters","Why the browser",[556,614,671],{"label":557,"title":558,"description":559,"colour":560,"useCases":561},"Tier 1","Uniquely solved in the browser","High security value · no other layer can see the attack","green",[562,573,584,595,606],{"name":563,"stats":564,"whyItMatters":571,"whyTheBrowser":572},"Account takeover prevention",[565,568],{"value":566,"description":567},"~15","identities per employee",{"value":569,"description":570},"2 in 5","accounts lack MFA","Account takeover is the dominant entry point for enterprise breaches. The attack surface extends well beyond what identity tooling can see: ghost logins, shadow SaaS apps outside IdP coverage, accounts without MFA, and credentials already compromised in earlier breaches.","Account takeover is a browser-native attack vector — attackers target users inside their browsers to compromise their identities on cloud services. The browser is the only layer with visibility of the full identity attack surface and the TTPs used to exploit it.",{"name":574,"stats":575,"whyItMatters":582,"whyTheBrowser":583},"Advanced phishing detection",[576,579],{"value":577,"description":578},"95%","of attacks use bot protection",{"value":580,"description":581},"89%","of phishing domains active under 2 days","AiTM phishing — where a reverse proxy intercepts credentials and session tokens in real time — is now the standard technique for bypassing MFA at scale. 1 in 2 payloads are now delivered outside email, and most attacks use redirects and cloaking techniques to mask malicious pages. The threat extends beyond credential phishing: authorization attacks like device code phishing bypass the login altogether (including passkeys).","Modern phishing pages are dynamic web applications rendered by the browser's JavaScript engine. Email gateways never see the destination page, and proxies can't see what's happening client-side. Blocklists chase the most disposable indicators attackers have. The browser is the only layer where you can observe the rendered page as the user sees it — the same shift the industry made from signature-based AV to behavioral EDR.",{"name":585,"stats":586,"whyItMatters":593,"whyTheBrowser":594},"Identity posture hardening",[587,590],{"value":588,"description":589},"1 in 4","logins use SSO",{"value":591,"description":592},"1 in 5","logins used a weak, breached, or reused credential","The average employee maintains ~15 identities across ~220 applications, and fewer than 1 in 3 support SAML SSO. In one snapshot, we found that 37% of accounts lacked MFA entirely and roughly 9% had a breached, weak, or reused password. Ghost logins — legacy local credentials that persist alongside SSO — appear in roughly 10% of accounts, providing attackers with a way around enterprise SSO.","IdPs enforce policy for federated applications, but self-adopted, unmanaged applications sit outside the reach of the IdP. The browser sees the login itself, discovering the identity at the moment it's created or used: authentication method, password strength, MFA status, and all. Being in the browser means acting at the moment of authentication — not just building an inventory.",{"name":596,"stats":597,"whyItMatters":604,"whyTheBrowser":605},"Browser extension security",[598,601],{"value":599,"description":600},"8.8M","browsers compromised by DarkSpectre",{"value":602,"description":603},"46.76%","of extensions have permissions for direct ATO","The Cyberhaven campaign compromised 35+ Chrome extensions reaching ~2.6 million users. DarkSpectre compromised 8.8 million browsers through extensions that held \"verified\" web store status throughout a seven-year operation. Analysis of 20,000+ enterprise extensions found 46.76% hold the permission combinations needed to perform account takeover with no user interaction.","SWGs and network tools are structurally blind to extensions running inside the browser: a malicious extension exfiltrating session tokens generates no anomalous network signal. Endpoint agents have no visibility into extension behavior at the session level. Even the stores' own review consistently fails to catch malicious updates. If detection can't happen at the store level, it has to happen in the browser.",{"name":607,"stats":608,"whyItMatters":612,"whyTheBrowser":613},"Shadow SaaS & OAuth governance",[609],{"value":610,"description":611},"1,000+","organizations hit in ShinyHunters campaign","45% of applications are purchased through expense channels rather than IT procurement, and that misses the larger population of self-adopted freemium accounts. OAuth connections across these unmanaged estates have become devastating: the ShinyHunters Salesforce campaign pivoted through harvested OAuth tokens to reach hundreds of connected services. Once issued, a token survives password resets, MFA changes, and session revocations.","Every OAuth consent grant transits the browser: the authorization prompt, the scope disclosure, the approval click, and the redirect. That makes the browser the only layer where an unwanted grant can be intercepted before the token is issued — and the only layer that observes the full application estate, because it captures the login itself at the moment an employee authenticates.",{"label":615,"title":616,"description":617,"colour":618,"useCases":619},"Tier 2","Browser is the strongest or a shared control point","High security value · works alongside other layers","amber",[620,631,642,650,661],{"name":621,"stats":622,"whyItMatters":629,"whyTheBrowser":630},"ClickFix & social engineering delivery",[623,626],{"value":624,"description":625},"4 in 5","ClickFix attacks delivered via search engines, not email",{"value":627,"description":628},"52%","of Push detections in Q2 2026","ClickFix was the most common initial access vector reported by Microsoft in 2025. The technique writes a malicious command to the clipboard and social-engineers users into executing it — fileless, user-executed, with 4 in 5 payloads arriving via search engines rather than email. New sub-techniques, lures, payloads, and ways of executing the malicious commands are constantly being added to ClickFix kits.","The browser is the earliest intervention point: detecting the clipboard injection and social engineering lure before anything reaches the endpoint in executable form. For ConsentFix, the browser is the only detection layer. When attacks arrive via malvertising, compromised websites, or trusted platform domains, the page loading in the browser is the first and often only detection opportunity.",{"name":632,"stats":633,"whyItMatters":640,"whyTheBrowser":641},"AI visibility & control",[634,637],{"value":635,"description":636},"16","GenAI apps at the average org",{"value":638,"description":639},"17","AI browser extensions per org","AI adoption is outpacing security governance at nearly every organization. But the security problems AI creates are largely existing Tier 1 problems amplified by a new category of tooling: shadow AI apps are shadow SaaS, AI OAuth integrations are OAuth governance, AI browser extensions are extension security, and personal AI account usage is an identity posture problem.","The browser sees the apps, the OAuth grants, the extensions, and whether the user is authenticated via a corporate or personal account. For unsanctioned AI tools, it provides the only real-time enforcement point. For AI agents operating through OAuth grants, the browser is where the consent decisions that authorize them are made.",{"name":643,"stats":644,"whyItMatters":648,"whyTheBrowser":649},"Investigation & incident response",[645],{"value":646,"description":647},"48%","of breaches involve browser-based activity","Endpoint logs show what processes executed, network logs show traffic destinations, IdP logs show authentication events — but none show what happened inside the browser session. This is the missing middle of modern investigations: the link between \"a user visited a URL\" and \"credentials were submitted to a phishing page that issued a session token now being replayed.\"","The browser fills the session gap that other sources miss. User and session timelines reconstruct the full sequence: what users clicked, what pages loaded, what credentials were entered, and what session activity followed. The same telemetry supports proactive scenarios like blast radius assessment when a third-party vendor announces a breach.",{"name":651,"stats":652,"whyItMatters":659,"whyTheBrowser":660},"Infostealer defense",[653,656],{"value":654,"description":655},"54%","of ransomware victims had prior infostealer event",{"value":657,"description":658},"46%","of infected systems with corp creds were personal devices","Infostealers are the upstream supply chain for a disproportionate share of the most damaging attacks — harvesting credentials, session cookies, and browser profile data en masse. The chain is self-reinforcing: ClickFix delivers infostealers, infostealers harvest accounts, compromised accounts distribute more ClickFix lures.","The browser is relevant at three points in the kill chain: delivery interception (ClickFix is the primary delivery mechanism), detecting stolen factors in use (breach dataset matching at login, session marker injection for stolen tokens), and as the credential leakage path itself (personal-account browser sync copies corporate passwords to unmanaged personal cloud accounts).",{"name":230,"stats":662,"whyItMatters":669,"whyTheBrowser":670},[663,666],{"value":664,"description":665},"26%","of GenAI uploads contain sensitive data",{"value":667,"description":668},"82%","of risky inputs happen via personal accounts","File uploads to unsanctioned services, sensitive data pasted into AI tools, and exfiltration through personal accounts are genuine risks. But DLP is a multi-layer problem: the browser is an important layer but not a standalone replacement — it can't see email-based loss, endpoint-to-endpoint transfers, or cloud API exfiltration.","Browser-layer controls provide real value, particularly for BYOD and contractors where endpoint DLP agents can't be deployed. The browser sees file uploads, downloads, clipboard activity, and AI prompt inputs, and can intervene in real time to stop risky and unapproved actions.",{"label":672,"title":673,"description":674,"colour":675,"useCases":676},"Tier 3","Other layers are better suited","Lower browser-specific value · evaluate last","red",[677,682,687],{"name":678,"stats":679,"whyItMatters":680,"whyTheBrowser":681},"URL \u002F domain controls",[],"Blocking known-bad URLs and domains is a long-established control, and it still removes commodity threats cheaply. But attackers rotate infrastructure faster than any list can track — most phishing domains are live for under two days, behind bot protection — so reputation-based blocking only catches what has already been seen elsewhere.","Secure web gateways, DNS filtering, and SASE platforms already enforce URL and domain policy across every app and device, not just the browser. A browser solution can apply the same lists, but it adds little a network control doesn't already provide — evaluate it as a convenience, not a reason to buy (and URL blocking doesn't mean effective phishing protection).",{"name":683,"stats":684,"whyItMatters":685,"whyTheBrowser":686},"Prompt injection",[],"As AI assistants and agentic browsers read web content on a user's behalf, instructions hidden in a page, document, or email can redirect what the model does — leaking data or taking actions the user never asked for. It's an emerging risk, and the techniques are still changing quickly.","Prompt injection is ultimately a weakness in how the model and the AI application handle untrusted input, so the strongest controls sit with the AI provider and the application's own guardrails. The browser adds visibility into which AI tools are in use and what is pasted into them, but it can't reliably tell a malicious instruction from ordinary page content.",{"name":688,"stats":689,"whyItMatters":690,"whyTheBrowser":691},"Browser exploit protection",[],"Exploits against the browser engine itself — memory corruption and zero-days used to escape the sandbox — are real but rare, and mostly reserved for high-value targets. Modern browsers patch quickly and update automatically, which keeps the window for most exploits short.","Browser vendors and endpoint protection are better placed here: vendors fix the engine, and EDR sees what an exploit does to the operating system once it escapes the sandbox. Keeping browsers up to date delivers most of the value.",[693],{"label":694,"linkType":504,"url":502,"variant":503,"file":505,"fileAction":506},"Download the full guide","Includes “what good looks like” criteria, vendor questions, and how to test it in a PoC.",{"large":697},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":699,"component":700,"responsiveStyles":758},"builder-6cad702462c04550b7e322a071758254",{"name":701,"tag":701,"options":702,"isRSC":33},"BuyersGuideSolutionMap",{"title":703,"introText":704,"hint":705,"solutions":706,"mattersText":752,"landsText":753,"ctas":754,"spacingBottom":83},"Deployment ease × security value","How easily each solution deploys into your environment, against how much security value it delivers on the threats the evidence says matter most.","Select a solution to explore",[707,715,722,728,734,740,747],{"name":708,"category":709,"x":710,"y":711,"pushMark":712,"builtFor":713,"landsHere":714},"Push Security","independent",79,83,true,"\u003Cp>\u003Cstrong>Built for the Tier 1 threat model:\u003C\u002Fstrong> identity attacks inside the browser session. Technique-class behavioral detection that fires even on previously uncatalogued kits on fresh infrastructure, backed by a dedicated threat research team.\u003C\u002Fp>","Extension-based deployment in minutes across Chrome, Edge, Firefox, and Brave — no migration barrier — with security value concentrated on the highest-priority use cases in the framework. That combination is what puts it top-right.",{"name":716,"category":717,"x":718,"y":719,"pushMark":6,"builtFor":720,"landsHere":721},"Jamf (KeepAware)","acquired",77,58,"\u003Cp class=\"\">\u003Cstrong class=\"\">What it’s built for:\u003C\u002Fstrong> Acquired extension covering the fundamentals: phishing, extensions, AI, and DLP. \u003C\u002Fp>","Deploys in minutes with no migration barrier. Lands below Push on value: lightweight coverage across use cases rather than deep detection of Tier 1 identity attacks. Expect priorities to shift post-acquisition toward Apple ecosystems.",{"name":723,"category":717,"x":724,"y":725,"pushMark":6,"builtFor":726,"landsHere":727},"CrowdStrike (Seraphic)",50,54,"\u003Cp>\u003Cstrong>What it’s built for:\u003C\u002Fstrong> Exploit prevention heritage — a Tier 3 use case — with identity claims added post-acquisition. Detection depth on identity attacks is untested at scale.\u003C\u002Fp>","The extension deploys via JavaScript runtime injection — a stability risk worth testing alongside the Falcon sensor. Value increasingly depends on the Falcon ecosystem; standalone value is unclear.",{"name":729,"category":717,"x":730,"y":731,"pushMark":6,"builtFor":732,"landsHere":733},"Akamai (LayerX)",66,44,"\u003Cp>\u003Cstrong>What it’s built for:\u003C\u002Fstrong> Governance and policy orientation — strongest on AI usage control, risk scoring, and access policy rather than detection oriented around attacker TTPs.\u003C\u002Fp>","Lightweight extension deployment scores well on ease. Since the acquisition, innovation is being redirected to Akamai platform capabilities, with long-term scope shaped by Akamai’s priorities.",{"name":735,"category":717,"x":736,"y":737,"pushMark":6,"builtFor":738,"landsHere":739},"Zscaler (SquareX)",63,34,"\u003Cp>\u003Cstrong>What it’s built for:\u003C\u002Fstrong> Malware sandboxing heritage: file-focused isolation in an increasingly malware-free attack landscape. No behavioral detection of identity attacks.\u003C\u002Fp>","Extension-based and easy to deploy, but browser-native innovation is being curtailed to fit Zscaler’s SWG model — the product won’t cannibalize proxy revenue.",{"name":741,"category":742,"x":743,"y":744,"pushMark":6,"builtFor":745,"landsHere":746},"Island","full-stack",38,48,"\u003Cp>\u003Cstrong>What it’s built for:\u003C\u002Fstrong> Full browser replacement optimized for IT workspace control: access governance, device posture, VDI replacement, and policy enforcement. Detection is known-bad blocking — policy rules on URLs, domains, and file types, with no behavioral detection.\u003C\u002Fp>","Adopting Island means asking every user to switch away from Chrome, which keeps deployments scoped to specific user groups. Security value is concentrated in IT controls rather than the attacks driving the most damaging breaches.",{"name":748,"category":742,"x":749,"y":737,"pushMark":6,"builtFor":750,"landsHere":751},"Prisma Browser",43,"\u003Cp>\u003Cstrong>What it’s built for:\u003C\u002Fstrong> Palo Alto’s full browser, built from the Talon acquisition. SASE-derived heritage — URL filtering and sandboxing — with “Live Page Scanning” layered on WildFire. Value is tied to being a PANW platform customer.\u003C\u002Fp>","Full browser migration limits coverage, with the extension positioned as a transitional on-ramp. Engineering focus has shifted from browser-native innovation to platform integration since the acquisition.","Full-stack enterprise browsers sit on the left: they require browser migration that limits deployment scope, and their security value is concentrated in IT workspace controls rather than the Tier 1 identity attacks that drive the most damaging breaches. The acquired extension vendors land in the center: they deploy more easily, but have trade-offs to consider around new priorities post-acquisition and vendor lock-in.","Push lands top-right: extension-based deployment with no migration barrier, and security value concentrated on the Tier 1 identity attacks that the guide’s framework identifies as the highest priority. That positioning follows directly from applying the evaluation criteria the preceding sections describe.",[755],{"label":756,"linkType":511,"url":757,"variant":503},"Book a demo to see Push in action","\u002Fdemo",{"large":759},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":761,"component":762,"responsiveStyles":902},"builder-771daf1dc4b04e22a36ad282f9f8374d",{"name":763,"tag":763,"options":764,"isRSC":33},"BuyersGuideSolutionComparison",{"title":765,"introText":766,"solutionsLabel":767,"dimensions":768,"groups":781,"ctas":899,"spacingBottom":83},"How the solutions compare","Each dimension maps directly to the use case ranking, evaluation criteria, and architectural analysis above. The framework is the same regardless of vendor — the outcomes differ because of what each was built to do.","Solutions",[769,771,773,775,777,779],{"label":770},"Threat Model Alignment",{"label":772},"Capability Depth",{"label":774},"Deployment & Coverage",{"label":776},"Operational Maturity",{"label":778},"Innovation Velocity",{"label":780},"Strategic Independence",[782,815,882],{"name":783,"colour":784,"solutions":785},"Full-Stack Browsers","purple",[786,800],{"name":741,"vendor":42,"highlight":6,"cells":787},[788,790,792,794,796,798],{"text":789},"IT workspace control. Policy enforcement and known-bad blocking — not built for identity attack detection.",{"text":791},"Known-bad blocking. Policy rules on URLs, domains, file types. No behavioral detection.",{"text":793},"Full browser replacement; extension is an on-ramp. Migration resistance limits scope.",{"text":795},"Mature platform, named enterprise customers. Strong IT workflow integration.",{"text":797},"Rapid expansion, but IT\u002Fproductivity-focused — not security research.",{"text":799},"Independent, but full replacement creates migration lock-in.",{"name":748,"vendor":801,"highlight":6,"cells":802},"Palo Alto Networks",[803,805,807,809,811,813],{"text":804},"SASE-derived: URL filtering and sandboxing heritage. Identity claims tied to the platform stack.",{"text":806},"“Live Page Scanning” layered on WildFire + URL filtering — supplements the reputation model.",{"text":808},"Full browser, “transitional” extension, mobile app. Extension positioned to upsell.",{"text":810},"Mature via the PANW stack. Value tied to being a PANW customer.",{"text":812},"Repositioned since Talon (Dec 2023). Effort shifted to platform integration.",{"text":814},"Tied to Prisma SASE. Platform lock-in by design.",{"name":816,"colour":347,"solutions":817},"Acquired Extensions",[818,834,850,866],{"name":819,"vendor":820,"highlight":6,"cells":821},"Falcon Seraphic Enterprise Browser","CrowdStrike",[822,824,826,828,830,832],{"text":823},"Exploit prevention heritage (Tier 3). Identity claims added post-acquisition.",{"text":825},"DOM attribute analysis for phishing (claimed). Depth untested at scale.",{"text":827},"Extension via JS runtime injection. Stability risk; test alongside the Falcon sensor.",{"text":829},"Falcon integration roadmap not fully shipped — buying future state.",{"text":831},"Post-outage stability priority absorbs engineering. Narrowing scope.",{"text":833},"Falcon ecosystem lock-in. Standalone value unclear.",{"name":835,"vendor":836,"highlight":6,"cells":837},"Zscaler Zero Trust Browser","Zscaler (formerly SquareX)",[838,840,842,844,846,848],{"text":839},"Malware sandboxing heritage. File-focused isolation in a malware-free landscape.",{"text":841},"File sandboxing. No behavioral detection of identity attacks.",{"text":843},"Extension-based. Limited pre-acquisition deployment history.",{"text":845},"Early-stage ZTE integration. $20M raised, acquired under a year post-Series A.",{"text":847},"Curtailed to fit Zscaler’s SWG model — browser-native innovation deprioritized.",{"text":849},"Tied to Zscaler platform. Will not cannibalize SWG revenue.",{"name":851,"vendor":852,"highlight":6,"cells":853},"Akamai Workforce Protector","Akamai (formerly LayerX)",[854,856,858,860,862,864],{"text":855},"Governance and policy orientation. Strongest on AI usage control, not threat detection.",{"text":857},"AI governance, risk scoring, access policy. Detection oriented around governance, not attacker TTPs.",{"text":859},"Extension-based. Lightweight deployment.",{"text":861},"Rebranded to Akamai SIA. Integration with Guardicore and EAA underway.",{"text":863},"Innovation redirected to Akamai platform capabilities.",{"text":865},"Tied to Akamai platform. Long-term scope shaped by Akamai’s priorities.",{"name":867,"vendor":868,"highlight":6,"cells":869},"Keep Aware","Jamf",[870,872,874,876,878,880],{"text":871},"Covers fundamentals: phishing, extensions, AI, DLP. Breadth over depth at seed stage.",{"text":873},"Broad but shallow use case coverage.",{"text":875},"Extension-based. Deploys in minutes.",{"text":877},"Early stage, recently acquired. Investigate whether output supports investigation workflows or generates policy alerts.",{"text":879},"Active but constrained by resources. Test against novel kits on fresh infrastructure.",{"text":881},"Recently acquired. Tied to Jamf's Apple-centric priorities.",{"name":883,"colour":560,"solutions":884},"Independent Extensions",[885],{"name":708,"vendor":42,"highlight":712,"cells":886},[887,889,891,893,895,897],{"text":888},"Built for the Tier 1 threat model: identity attacks inside the browser session. ATO, phishing, identity posture, extensions, shadow SaaS, OAuth.",{"text":890},"Technique-class behavioral detection. Fires on zero-day kits on fresh infrastructure. Agentic detection pipeline with autonomous threat hunting.",{"text":892},"Extension-based. Deploys in minutes across Chrome, Edge, Firefox, Brave — including agentic browsers. No migration required.",{"text":894},"Production-scale. SIEM, SOAR, and IdP integration. Investigation timelines and custom detection rules.",{"text":896},"Dedicated threat research team. Has broken and named multiple browser-native attack techniques (ConsentFix, InstallFix, cross-IdP impersonation, ghost logins).",{"text":898},"Independent. Engineering concentrated entirely on browser security capability.",[900],{"label":901,"linkType":504,"url":502,"variant":503,"file":505},"See the full comparison in the guide",{"large":903},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"@type":45,"@version":46,"id":905,"component":906,"responsiveStyles":927},"builder-fa061b86b26643e3bc2329664fc5e6d6",{"name":907,"tag":907,"options":908,"isRSC":33},"BuyersGuideTheFramework",{"title":909,"introText":910,"bullets":911,"ctas":924,"spacingBottom":83},"The framework goes much deeper","Get the full guide for the evaluation criteria, PoC guidance, vendor deep-dives, the complete business case framework, and 50+ questions to ask every vendor you evaluate.",[912,914,916,918,920,922],{"text":913},"10 evaluation criteria",{"text":915},"50+ vendor evaluation questions",{"text":917},"How to run a PoC that surfaces real differences",{"text":919},"Detailed vendor-by-vendor analysis",{"text":921},"Business case framework with five value drivers",{"text":923},"Funding routes and investment risk management",[925],{"label":926,"linkType":504,"url":502,"variant":503,"file":505,"fileAction":506},"Download the browser security buyer’s guide",{"large":928},{"display":63,"flexDirection":64,"position":65,"flexShrink":66,"boxSizing":67},{"id":930,"@type":45,"tagName":73,"properties":931,"responsiveStyles":932},"builder-pixel-nb8phl46zlb",{"src":75,"aria-hidden":76,"alt":42,"width":66,"height":66},{"large":933},{"height":66,"width":66,"display":79,"opacity":66,"overflow":80,"pointerEvents":81},"\u002Fresources\u002Fbrowser-security-buyers-guide",{"deviceSize":83,"location":936},{"path":42,"query":937},{},[],"67baa0b3a917443a90334d7953538914",1792746982152,{"breakpoints":942,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":943},{"medium":16,"small":17,"xsmall":18},"page","2ed088cf4ec2428da964c54114f4003a",[946],{"@type":947,"operator":948,"property":949,"value":934},"@builder.io\u002Fcore:Query","is","urlPath",{},1791468043568,"https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffee8eaf826c04b76ad704f1f13001d50","24odrjc42d1",[955,977,997,1014,1029,1046,1065],{"createdBy":474,"createdDate":956,"data":957,"folders":967,"id":968,"lastUpdateSource":33,"lastUpdated":969,"lastUpdatedBy":474,"meta":970,"modelId":972,"name":966,"published":13,"query":973,"stageModifiedSincePublish":6,"testRatio":29,"variations":974,"firstPublished":975,"rev":976},1791542761768,{"bypassMode":958,"bypassPoints":959,"name":966},"throughAndAround",[960,962,964],{"text":961},"\u003Cp>Deliver over non-email channel\u003C\u002Fp>",{"text":963},"\u003Cp class=\"\">Send emails from trusted apps\u003C\u002Fp>",{"text":965},"\u003Cp class=\"\">Don’t use known-bad domains — constant rotation\u003C\u002Fp>","Email",[],"f8cca749314b4a6bbd4845bd5b5f4959",1791542830758,{"breakpoints":971,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},"d64e47637ae6485bb9d34b7b6f7d95ca",[],{},1791542830752,"mqjcfukapv8",{"createdBy":474,"createdDate":978,"data":979,"folders":989,"id":990,"lastUpdateSource":33,"lastUpdated":991,"lastUpdatedBy":474,"meta":992,"modelId":972,"name":988,"published":13,"query":994,"stageModifiedSincePublish":6,"testRatio":29,"variations":995,"firstPublished":996,"rev":976},1791542851482,{"bypassMode":980,"bypassPoints":981,"name":988},"through",[982,984,986],{"text":983},"\u003Cp>Evade malicious download detections through HTML smuggling\u003C\u002Fp>",{"text":985},"\u003Cp class=\"\">Client-side reassembly of complex encoded web pages bypasses traffic signatures\u003C\u002Fp>",{"text":987},"\u003Cp class=\"\">Rapid domain rotation effectively bypasses domain blocklists\u003C\u002Fp>","Secure Web Gateway",[],"36ed93748d2e41528c4d168f93197d9e",1791542908287,{"breakpoints":993,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791542908283,{"createdBy":474,"createdDate":998,"data":999,"folders":1006,"id":1007,"lastUpdateSource":33,"lastUpdated":1008,"lastUpdatedBy":474,"meta":1009,"modelId":972,"name":1005,"published":13,"query":1011,"stageModifiedSincePublish":6,"testRatio":29,"variations":1012,"firstPublished":1013,"rev":976},1791542928172,{"bypassMode":958,"bypassPoints":1000,"name":1005},[1001,1003],{"text":1002},"\u003Cp>RBI is designed to protect against exploits, not attacks happening inside the browser e.g. account takeover\u003C\u002Fp>",{"text":1004},"\u003Cp class=\"\">RBI is typically activated based on domain and URL level indicators that attackers are routinely evading anyway\u003C\u002Fp>","Remote Browser Isolation",[],"b531c45b5cdc49ff8fffbeefbfa2bd1e",1791542965442,{"breakpoints":1010,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791542965436,{"createdBy":474,"createdDate":1015,"data":1016,"folders":1021,"id":1022,"lastUpdateSource":33,"lastUpdated":1023,"lastUpdatedBy":474,"meta":1024,"modelId":972,"name":1020,"published":13,"query":1026,"stageModifiedSincePublish":6,"testRatio":29,"variations":1027,"firstPublished":1028,"rev":976},1791543009696,{"bypassMode":958,"bypassPoints":1017,"name":1020},[1018],{"text":1019},"\u003Cp>Evade malicious download detections through HTML smuggling, or fileless malware delivery methods like ClickFix\u003C\u002Fp>","File Sandbox",[],"28c4b747107e4afcb6fd4ab862ae4bb6",1791543037972,{"breakpoints":1025,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791543037966,{"createdBy":474,"createdDate":1030,"data":1031,"folders":1038,"id":1039,"lastUpdateSource":33,"lastUpdated":1040,"lastUpdatedBy":474,"meta":1041,"modelId":972,"name":1037,"published":13,"query":1043,"stageModifiedSincePublish":6,"testRatio":29,"variations":1044,"firstPublished":1045,"rev":976},1791543056837,{"bypassMode":958,"bypassPoints":1032,"name":1037},[1033,1035],{"text":1034},"\u003Cp>Most attacks now don’t touch the endpoint\u003C\u002Fp>",{"text":1036},"\u003Cp class=\"\">When they do, methods like ClickFix enable stealthy malware execution\u003C\u002Fp>","Endpoint Security",[],"0dbb764745f446c3a02f517f7f228786",1791543095957,{"breakpoints":1042,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791543095951,{"createdBy":474,"createdDate":1047,"data":1048,"folders":1057,"id":1058,"lastUpdateSource":33,"lastUpdated":1059,"lastUpdatedBy":474,"meta":1060,"modelId":972,"name":1056,"published":13,"query":1062,"stageModifiedSincePublish":6,"testRatio":29,"variations":1063,"firstPublished":1064,"rev":976},1791543114858,{"bypassMode":980,"bypassPoints":1049,"name":1056},[1050,1052,1054],{"text":1051},"\u003Cp>2 in 5 logins not protected by MFA, “ghost logins” circumvent SSO\u003C\u002Fp>",{"text":1053},"\u003Cp class=\"\">\u003Ca href=\"\u002Fblog\u002Fmfa-downgrade-attacks\u002F\" rel=\"noopener noreferrer\">Downgrade attacks\u003C\u002Fa> can circumvent phishing-resistant auth\u003C\u002Fp>\n",{"text":1055},"\u003Cp class=\"\">Many attacks like device code phishing are post-auth, meaning they succeed regardless of login controls e.g. passkeys\u003C\u002Fp>","Identity & Authentication",[],"0b166cb59261470eac383b82ff7b7fc9",1791543186495,{"breakpoints":1061,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791543186484,{"createdBy":474,"createdDate":1066,"data":1067,"folders":1074,"id":1075,"lastUpdateSource":33,"lastUpdated":1076,"lastUpdatedBy":474,"meta":1077,"modelId":972,"name":1073,"published":13,"query":1079,"stageModifiedSincePublish":6,"testRatio":29,"variations":1080,"firstPublished":1081,"rev":976},1791543212797,{"bypassMode":980,"bypassPoints":1068,"name":1073},[1069,1071],{"text":1070},"\u003Cp>In-app exploitation blends in with normal user activity\u003C\u002Fp>",{"text":1072},"\u003Cp class=\"\">Cloud logging is inconsistent from app to app, creating visibility gaps\u003C\u002Fp>","Cloud Security",[],"b6468917c88048dbaa2fed36c1a1d382",1791543247477,{"breakpoints":1078,"hasAutosaves":6,"hasErrors":6,"kind":19},{"medium":16,"small":17,"xsmall":18},[],{},1791543247470,{},1793113265492]