Browser Security
A Cyber SaaS Analysis 2026Key findings
- We narrowed the market to 13 products. Session and OAuth token security appears only in the top tier.02
- 82% of detections were malware free. Attackers log in and use legitimate tools instead.04
- 308 million stolen browser cookies linked to Australia were listed for sale. Nearly 25 million were still active.04
- Architecture sets the ceiling. An extension on its own can’t see DNS traffic, which rules out true zero trust network access.05
Work moved to the browser. Most security controls didn't follow it there.
Business applications have largely moved to SaaS, and staff now reach them through a browser. Credentials are entered there, files move through there, and with generative AI, more and more sensitive information passes through a text box in a browser tab.
The rest of the security stack was built to watch somewhere else: the inbox, the device, the network, the sign-in. Attacks that slip past email and past the user tend to land in the session between them, where most controls lose sight.
This report looks at that layer: what browser security can see and stop inside the session, how it sits alongside the controls you already run, and where it can replace a VPN. We assessed each product on its architecture first, because that sets what it can see.
Product Landscape
Comparing browser security products is complex. Solutions overlap and differ in approach; browser extensions, enterprise browsers and cloud-hosted isolation platforms. The Tekspace Landscape ranks 13 of the best browser security products in one transparent, measurable spectrum.
Focused
-
Check PointBrowser Security
-
ManageEngine
-
SquareX
Features
- Phishing Detection & Prevention
- Web Filtering & Application Control
- Credential Theft Protection
- Agentless Deployment
- Data Loss Prevention
- Multi-Browser Support
- Shadow AI Usage Detection
- File Upload/Download Control
- BYOD/Unmanaged Device Access
- Browser Session Telemetry
- Extension Risk Management
- Malware & Zero-Day Protection
- Remote Browser Isolation
Broad
-
AkamaiLayerX
-
Apozy
-
Conceal
-
Acium
-
KeepAware
-
Red Access
Features
- Zero Trust Browser Security
- SIEM/SOAR Integration
- VPN Replacement via ZTNA
- Shadow IT Detection & Control
- Human Risk Management
- Vendor Deployment Integrations
- Advanced DNS Protection
- Prompt Recording & Capturing
- AI-Powered Threat Detection
- Reporting & Dashboard
- Content Disarm & Reconstruction
- Identity & SSO Management
- Policy Enforcement & Governance
- Threat Intelligence Integration
- MSP Multi-Tenancy
- Zero Trust Files
- Zero Trust Credentials
Comprehensive
-
CrowdStrikeSeraphic
-
Push Security
-
Menlo Security
-
DefensX
Features
- Browser Detection & Response
- SaaS Security Posture Management
- Password Hygiene & Enforcement
- Adware & Ad Blocking
- Screen & Print DLP
- Automated Threat Response
- One-Click LLM Security Hardening
- Sensitive Data Protection via Regex Pattern Matching
- OAuth & Token Security
- Compliance Certification
We understood 400+ disparate features across the thirteen vendors, normalising them down to 40 scored features in 12 capability groups, each group sitting under one of the four security outcomes that follow and each feature ranked by its technical depth.
Want to know which of these fits your environment? We help with that.
A logo on a chart does not tell you whether the tool covers the unmanaged devices your contractors are on, or the AI tools your people have already adopted.
Book your sessionSecurity Outcomes
With the market mapped, what do information technology professionals prioritise when considering a browser security solution?
- Frank De Pasquale, Chief Executive Officer at Tekspace
- Stacy Gurrie, Chief Executive Officer at Byte
- Mathew Jose, Chief Information Security Officer at CodeBlue NZ
Every organisation has its own priorities. Yet time and again, these four outcomes rise to the top. Open each to see what matters in browser security.
Stops threats inside the browser session, including risky AI and SaaS use.
- Intervention inside the browser session itself, not at the network edge
- Credential theft, malicious extensions and zero-day web content stopped in place
- Generative AI and unsanctioned SaaS use governed at the point of interaction
Threat Context
Insights from 
The browser is the primary work surface for Australian organisations, yet most security controls have zero visibility.
The average Okta customer now runs 101 apps1 and staff access those apps through the browser, in sessions outside the view of security.
In FY2024-25, ASD responded to 11% more cyber incidents, and the average self-reported cost of a business cybercrime report rose 50% to $80,850.2
When the IT team locks down AI tools or restricts SaaS access overnight without guidance, staff route around it, moving to personal devices, personal accounts, or personal subscriptions.
The browser is now the front door
-
82%
Of detections were malware free
Attackers log in and use legitimate tools instead.8
-
46%
Of infostealer-infected systems with corporate logins were unmanaged
Outside the reach of endpoint agents.9
-
42%
Of incidents ASD rated C3 or higher involved compromised credentials
The most serious incidents ASD handled in 2024-25.2
Sources: CrowdStrike Global Threat Report 20268; Verizon DBIR 20259; ASD Annual Cyber Threat Report 2024-25.2 Bars to scale on a 0 to 100% axis.
From session data
to sold on the dark web
The browser is where attackers steal credentials and active session tokens. The dark web is where they profit.
Attackers buy adversary-in-the-middle phishing kits3 to steal valid tokens. Once an attacker holds a valid session token, they inherit all that user's access without triggering any further authentication challenge.
In practice The Vercel breach, April 2026
In April 2026, Vercel disclosed a breach that began at Context.ai, a third party AI tool one of its staff had trialled. A Context.ai employee’s computer was infected with the Lumma infostealer. Context.ai says an attacker then reached its AWS environment and likely took OAuth tokens. One belonged to a Vercel employee who had signed up with a corporate Google account and granted “Allow All” access. The attacker used it to take over the account and move into Vercel’s systems. Nobody broke through Vercel’s perimeter.4
A supply chain you don't control
Stolen browser cookies linked to Australia, listed for sale on dark web forums and Telegram channels.10
Nearly 25 million of those Australian cookies were still active when listed for sale.10
What a seller asked for the Vercel data, the same weekend Vercel disclosed a breach that began one vendor away, at Context.ai.4
Sources: NordVPN with NordStellar, May 202510; Vercel, Hudson Rock and BleepingComputer, April 2026.4
AI is reshaping what "trust the browser" means
Enabling staff with AI is now urgent, and most organisations are already behind it: three in four workers in Australia and New Zealand now actively use AI apps, up from 53% a year earlier.5
Attackers exploit that gap by cloning popular AI assistant extensions: in January 2026, two fake AI sidebar extensions were found stealing ChatGPT and DeepSeek chats from about 900,000 users. Some legitimate extensions have added similar collection as a product feature: Secure Annex found the Similarweb extension began capturing AI prompts and responses after a May 2025 update.6 Detection means watching extension behaviour over time, not just at install.
Agentic browsers, the kind that take actions on a user's behalf, read untrusted webpage content as if it were a user instruction. A staff member asks the agent to summarise a Reddit thread. Hidden text in a comment tells it to collect the user’s email address and a one-time login code from Gmail and post them back to Reddit, handing the attacker the account. There is no phishing click and no malware, just the user’s own signed-in session doing the attacker’s work.7
No clean technical fix
See the five steps, August 2025 to March 2026
-
Aug 2025 Brave Security
Shows Perplexity Comet can be hijacked by hidden instructions in a web page, and finds Perplexity’s first fix incomplete.
-
Oct 2025 LayerX: CometJacking
A single crafted link can make Comet’s assistant send a user’s connected Gmail and Calendar data to an attacker.
-
Oct 2025 Brave Security
Near-invisible instructions in screenshots and web pages can hijack Comet, Fellou and other AI browsers.
-
Oct 2025 OpenAI: ChatGPT Atlas
Launches with a logged-out mode to limit the agent’s access. By December, says prompt injection is unlikely ever to be fully solved.
-
Mar 2026 Zenity Labs: PleaseFix
Attacker content such as a calendar invite can silently hijack Comet to steal local files and take over a user’s 1Password account.
Hover over a step for the detail.
Sources: Brave; LayerX; OpenAI; Zenity Labs, August 2025 to March 2026.7 Events are evenly spaced, not to scale.
Browser security stays in the session, which makes it the reliable control when productivity and exposure pull in different directions. It's the layer that enables staff productivity, while giving leadership the confidence that staff are using those tools correctly.
Category Findings
Browser security is an architectural shift, and your last line of defence when every other control has failed.
Many of the corporate breaches we assess could have been stopped at the browser. Its most valuable capability is what no other layer offers: visibility inside the session. That is what tells an approved tool apart from sensitive data being pasted into a personal account, letting teams unlock productivity without adding exposure.
Where it sits in your stack
Email security judges the message, EDR watches the device, and identity checks the person at sign-in, then issues a session token that carries their access from there. SSE and SASE platforms inspect traffic in transit, and some now add browser controls on top. The session sits between all of them, and browser security is the control placed inside it. With zero trust network access it can also retire VPN, VDI and DNS point solutions, which in our experience is the most overlooked capability in the category.
Architecture sets the ceiling. A browser extension on its own cannot see traffic at the DNS level, which rules out true zero trust network access. Check that rules still hold when someone switches browser or opens a private window, and whether sensitive data can be stripped from a prompt before it leaves the browser.
Where to start
Most organisations arrive with a narrower problem: where staff can go, intellectual property leaving, or an incident that ended in the browser. Start there.
- Write down the problem, and how you will know it is solved.
- Map the business systems staff use in the browser and the data each one holds.
- Run a shortlisted product in monitor-only mode with ten to twenty everyday users, so you see your own data before you set policy.
- Apply controls where the risk sits, one group at a time.
Several specialists in this report now sit inside larger security platforms, so if you already run one, test how deep its browser layer goes. Match the architecture to your risk; you may not need every capability on day one. We hope this research helps you make a deliberate, not reactive, choice.
Addendum
Credits
In launching this report, the Tekspace would like to acknowledge contributions from the following teams and individuals.
Contributors
- Lead Analysts — Frank De Pasquale, CEO at Tekspace.
- Threat Context — Martin Dybalski, Director; Stuart Shanahan, Director of Technical Services; and Kris Bowen, Senior Offensive Security Consultant, all at Parabellum.
- Security Outcomes — Mathew Jose, Chief Information Security Officer at CodeBlue New Zealand; and Stacy Gurrie, Chief Executive Officer at Byte.
- Research and analysis by the Tekspace Research team.
Browser Security category
What this report does and doesn’t claim to cover and how we compare products fairly. Further questions, disclaimers and references follow at the end of the page.
Scope
This report evaluates browser-native edge security platforms delivering web threat prevention, browser-based data loss protection, SaaS access governance, and GenAI usage controls. It does not cover traditional network security products (SASE, SD-WAN, secure web gateways operating at the network layer), standalone endpoint detection and response platforms, or broader governance/risk/compliance tools.
Feature Granularity Model
We compare products at what we call Level 2: The Functional Group: specific enough to be meaningful, broad enough to compare very different products fairly, without losing sight of how they’re meaningfully different.
Focused
-
Check PointBrowser Security
-
ManageEngine
-
SquareX
Features
- Phishing Detection & Prevention
- Web Filtering & Application Control
- Credential Theft Protection
- Agentless Deployment
- Data Loss Prevention
- Multi-Browser Support
- Shadow AI Usage Detection
- File Upload/Download Control
- BYOD/Unmanaged Device Access
- Browser Session Telemetry
- Extension Risk Management
- Malware & Zero-Day Protection
- Remote Browser Isolation
Broad
-
AkamaiLayerX
-
Apozy
-
Conceal
-
Acium
-
KeepAware
-
Red Access
Features
- Zero Trust Browser Security
- SIEM/SOAR Integration
- VPN Replacement via ZTNA
- Shadow IT Detection & Control
- Human Risk Management
- Vendor Deployment Integrations
- Advanced DNS Protection
- Prompt Recording & Capturing
- AI-Powered Threat Detection
- Reporting & Dashboard
- Content Disarm & Reconstruction
- Identity & SSO Management
- Policy Enforcement & Governance
- Threat Intelligence Integration
- MSP Multi-Tenancy
- Zero Trust Files
- Zero Trust Credentials
Comprehensive
-
CrowdStrikeSeraphic
-
Push Security
-
Menlo Security
-
DefensX
Features
- Browser Detection & Response
- SaaS Security Posture Management
- Password Hygiene & Enforcement
- Adware & Ad Blocking
- Screen & Print DLP
- Automated Threat Response
- One-Click LLM Security Hardening
- Sensitive Data Protection via Regex Pattern Matching
- OAuth & Token Security
- Compliance Certification
We'll connect you with the right people
By making an enquiry you agree to Tekspace contacting you about it and sending related research. Unsubscribe any time.