I was walking a client through their security stack last month when I realized we were looking at eight different tools—CrowdStrike, a VPN, DLP software, password managers, the list goes on—all designed to protect what people do in Chrome.
Eight disparate tools. One browser.
We’ve been solving the wrong problem. For the past 15 years, knowledge work moved entirely into the browser. Every application became a web app. Every workflow became a series of tabs. But our security approach stayed stuck in the era of standalone applications and physical desktops.
Enterprise browsers fix this, but not the way most people think.
The Name Is Doing This Category No Favors
When people hear “enterprise browser,” they immediately think we’re taking away their Chrome. I see it every time. The reaction is instant: “You want me to force my entire company to switch browsers? People are married to the browser they use.”
Here’s what actually happens: you keep using Chrome. Or Safari. Or whatever you’re comfortable with. You just install a plugin that layers in the security features. People don’t see it, don’t know it’s there, but you get all the same capabilities, the same familiar experience.
The whole category would probably be better off with a different name like “Browser Plus” or something that doesn’t make people think you’re replacing the tool that’s basically become another arm for knowledge workers. But Gartner coined “enterprise browser” and we’re stuck with it.
Where Your Traffic Actually Goes
Zero trust is a term people throw around constantly. The basic idea: everybody’s web traffic and connectivity go through a central node where all the policies get applied. That’s where you make sure data isn’t being leaked or sent to places it shouldn’t be. That’s where pre-web traffic gets reviewed and inspected against rule sets.
Here’s what that solves: customers have a network, whether they’ve got a physical facility or people working remotely. Their users’ web traffic goes somewhere before it gets to the internet. And they generally struggle to apply and implement all of the security controls that they should have to validate what people are doing.
The benefit of these enterprise browsers is that it’s much easier to do those things in these newer tools than legacy players.
The Device Doesn’t Matter Anymore
I spoke with a healthcare organization last year. They were planning to double in size. Their entire workforce that actually delivers services is remote. They were going to buy a couple thousand MacBooks and load all this software on them.
But their workers are healthcare workers doing stuff while they’re on break in hospitals. They probably don’t want to lug around a MacBook.
What if they could use their phone or their iPad or whatever they already have? Download the plugin and get all the security benefits you’re used to having.
Even for me, I use a company issued computer, and there’s days where I kind of like my personal computer more and probably could use it in place of it. But from an IT perspective, they don’t have the same level of visibility. And no one wants someone in IT to say, “Hey, why haven’t you used your computer in six months?”
If you’re using an enterprise browser, you would just download it or install the plugin. No friction or disruption and all the security.
Password Management That Actually Works
Enterprise browsers have their own password managers built in. But they work a lot better because they’re cooked into the same environment instead of being a standalone app.
A lot of times when you go to log into something, you don’t even see the login page. You’re just in.
If you’re on the technical side and logging into servers, it gets even easier. If you were my contractor and I wanted to give you access to login to a server, I can share that password with you and have you never see what that password is. When you go to that location, it’s just going to log you in.
Those permissions within a team are completely frictionless. They’re already pre-arranged.
Google Isn’t Going to Save You
The objection I hear most often: “Instead of buying another product, I’d rather just go to Google and use their browser solution”
Two problems. First, they’re actually behind what companies like Island are doing. Island’s development team is double the size of Google Chrome’s. They’re able to do stuff that’s generally years ahead of Google, for which enterprise browsing is a side hustle.
Second—and this is the bigger issue—Chrome is a consumer-based browser. Google makes money on logging everything everyone does with their browser, whether you like it or not. Every single Google search that’s ever been queried has always been logged since day one. Your data is how they make their money, and that is priority #1.
Everyone Talks About Data Going Out. What About What Comes In?
For the past 15 years, organizations with very sensitive data—anything in regulated environments—have had the same playbook. They don’t want that data on people’s computers, sitting in downloads folders. So they stand up a virtual desktop infrastructure where someone opens Chrome or an app, logs in, and gets a desktop inside their computer to manipulate the data so it stays in that little box.
Very expensive. From a management perspective, it’s a second environment that somebody’s got to pay for and update and handle password resets for.
Enterprise browsers can replace that entire solution because all those security controls are baked in. From a cost savings perspective, that is a massive value-added use case.
If you’re in your corporate Outlook and you copy some text, then you open your personal Gmail and try to paste it, you can set up rules to prevent the stuff you copied from being pasted anywhere. You can prevent it from getting downloaded. You can add watermarks and QR codes.
I’m an ex-auditor. For 10 years I consulted with healthcare companies and said, yeah, if you want to be compliant, the easiest way to meet these requirements is to stand up this big, complex virtual infrastructure. I had to build it personally for some of these companies because they didn’t know how to do it.
The stuff they’ve done to try and say, hey, you don’t need this big, bloated virtual desktop stuff, is phenomenal. And it’s really not necessary anymore.
Two Characteristics Drive Everything
Not every organization needs this. If you’re in the consumer resale space, it’s probably not as strong as a fit.
But if you’re in a regulated environment—financial space, healthcare space, manufacturing organizations, any organization that does a lot with intellectual property and patents—you should be paying attention.
Two characteristics mean you’re a good candidate for an enterprise browser: hybrid or remote workforce, and regulated environment.
Anybody that has to deal with an audit or an auditor is a really good candidate. One of the biggest and proudest customers is Pfizer. Healthcare companies tell me: “If I try to tell my auditor this is what I’m doing instead of using all this old technology they’re used to auditing, they’re going to think I’m trying to be cute with them. They’re going to think I’m trying to pull a fast one.”
Fair concern. But when you can point to Pfizer using the same approach, that conversation gets a lot easier.
____
James Cassata is a Senior Security Architect at Myriad360, where he helps organizations design modern security strategies for cloud, SaaS, and emerging technologies. Connect with him on LinkedIn to continue the conversation. Follow James on LinkedIn.
