Menlo Security today announced what it describes as the first cloud-delivered secure enterprise browser solution.

Based on the Menlo Secure Cloud Browser, the software-as-a-service (SAAS) offering delivers enterprise browser security, protecting users wherever they work and securing applications from internet-borne attacks.

“Employees spend 75% of their workday in the browser, making secure browsing an essential requirement for every enterprise,” Amir Ben-Efraim, CEO and co-founder of Menlo Security, said in a statement. “Traditional approaches to cybersecurity are failing. Phishing regularly evades all existing protections, and ransomware doubled in 2023 to over $1 billion in payments. We need a new approach, and browser security is ground zero.”

Users can retain their preferred browser by adopting the Menlo Security browser extension. The Menlo Security Client, an optional component, adds support for legacy client-server applications. The Menlo Secure Cloud Browser empowers hybrid workers, contractors and bring-your-own-device (BYOD) users to do business securely.

The enterprise browser security market is relatively small, but Menlo Security is the biggest player, Zeus Kerravala, founder and principal analyst of ZK Research, told SDxCentral. “At first, Menlo was a solution looking for a problem,” he said. “But thanks to remote and hybrid work, the problem has come to them. Businesses are turning to web apps and SaaS, so it makes sense.”

“Security has always been done in layers, and the browser was kind of ignored because you had endpoint protection,” Kerravala added. “But you can pick up on things before they get to the endpoint. While you won’t catch everything, browser security is the first line of defense.”

Menlo claims it has enhanced cloud-delivered browser security with the following capabilities:

• Cloud-delivered security: Protects users regardless of location or device.
• Zero-trust access: Extends secure access to applications and data beyond web sessions, including legacy applications and unmanaged devices.
• Data protection: Offers enhanced measures to prevent data leakage from the browser, including copy-paste control and user-input limits.
• Browser policy management: Simplifies configuration and policy enforcement for Google Chrome and Microsoft Edge.

“I’d like to see Safari support,” Kerravala said. While he doesn’t see Edge as a dominant enterprise browser currently, he added, “Don’t underestimate Microsoft’s ability to get people to use products they hate.”

Menlo Security said the enterprise security browser is designed to accomplish the following:

• Minimize the attack surface and protect against browser-based threats.
• Offer management of browser policies and centralized security controls.
• Provide a more cost-efficient option than virtual desktop infrastructure (VDI) or replacing browsers entirely.

New capabilities include:

• Menlo Security Browser Posture Manager: Provides browser configuration assessment and instant attack surface analysis. In 2023, 175 common vulnerabilities and exposures (CVEs) classified as high or critical were issued, and over 125 new features were added to Chromium, the open-source browser project underlying Google Chrome and Microsoft Edge, according to Menlo Security.
• Menlo Security Browser Posture Manager: Automates processes and enables administrators to define and deploy browser policies instantly.
• Menlo Browser Extension and Menlo Security Client: Extends zero-trust access to more users, devices and applications. The Menlo Browser Extension supports unmanaged devices and adds a self-service deployment option. The Menlo Security Client enables cloud-based access to legacy applications.

Menlo Security claims its browser security product is used by about 8 million users in nearly 1,000 global enterprises and government organizations, including the U.S. Department of Defense.

Focusing on cloud-based security makes sense, Kerravala said, given the updates that need to be pushed down to devices if not managed through the cloud. “Companies like Netskope and Zscaler -- who both offer secure access service edge (SASE) – have proven you can do security through the cloud,” he said. “It’s hard to ignore.”