Menlo Security Acquires Votiro to Deliver Easy, AI-driven Data Security to Enterprises
Read Blog
This blog examines a critical CISO decision: securing the browser security gap against Highly Evasive Adaptive Threats (HEAT) via endpoint or cloud solutions. Endpoint strategies, like forced replacement browsers, can standardize security but create significant trade-offs. Restricting browser choice risks breaking compatibility for custom applications and degrades performance for compute-intensive tasks by requiring security hardening (e.g., disabling JIT/Wasm). Replacement browsers also impact user productivity and satisfaction. This discussion offers a cloud-based alternative path to Browser Security, that secures any browser and preserves application compatibility, performance, and user preference. Organizations must fully weigh the ramifications of browser choice before committing to an architecture.
—--
In the first blog of this series, published on October 16, 2025, we covered the browser security gap, which is the gap that exists between EPP and network security tools, and can be exploited by HEAT atacks. We then explained that you have a crucial architectural decision on how to close the browser security gap. So that you don’t have to click back, the fundamental browser security architectural choice is to do it:
1. At the endpoint
2.In the cloud
Browser security at the endpoint is dominated by replacement browsers, like Palo Alto Prisma Browser, Surf, Island, etc, that replace all of the organization’s existing browsers with a uniform Chromium-based browser that is intended to present a hardened attack surface compared to mainstream browsers. As we have seen, this still presents exploitable gaps, particularly by zero-day attacks.
But there is another important choice which is eliminated by the deployment of a replacement browser: the choice an organization may make to deploy or retain multiple browsers, for reasons which we will detail below.
Browser choice matters. Let's talk about why.
CISOs across the globe tell us they typically support multiple browsers. The Menlo Cloud, delivers browser security to well over a 1000 customers and 8 million users worldwide, and we see large customers using various combinations of Microsoft Edge, Firefox, Safari, seven differing versions of Chrome, and even IE-11.
Why? Because the needs and realities of their business demand that they support more than one browser.
Choosing a replacement browser causes organizational browser choice to vanish, leading to serious repercussions.
First, consider application compatibility. The obvious risk when there is a forced browser standardization is that there may be important applications in use that explicitly support a single browser only. Even if a particular application works on a non-supported browser, accepting the risk that something could break in the next version without recourse runs against the ethos of most IT organizations.
The less obvious risk is that the replacement browser, in the spirit of hardening the browser attack surface, may block critical capabilities in active applications. While IT security and endpoint teams will typically perform extensive, broad compatibility testing and reviews when introducing a new browser, things get missed. We recently saw a situation where a company that selected a replacement browser didn’t foresee that the replacement browser would block the telephony component of a desktop application, which was a part of key customer support workflows.
So how do such things happen? The Island replacement browser disables the Chromium Just-in-Time (JIT) Compiler and the WebAssembly (Wasm). There are two main negative side effects of pursuing security in this way:
Organizations should be wary of the modest performance improvement claim from Island. Island will say, basic web browsing works fine, maybe even better. You’ll love us. Later, when the high-value, compute-intensive business applications identified above hamper productivity or just don’t work for all users in all locations, they’ll say, Sorry, security has its impacts.
Second, organizations adopting replacement browsers risk hobbling their users with a limited toolset. Both Microsoft and Google regularly add new productivity and security features to Edge and Chrome, and such innovations are often delayed or not available in Chromium or the replacement browsers based on the Chromium project. And because we can’t see the future, organizations adopting replacement browsers risk being left behind as leading browsers integrate with other productivity tools like Google Workspace and Microsoft Office 365, and increasingly, with emerging GenAI technologies. A feature like Microsoft Edge Workspaces, which enables browser-based collaboration, is not available within Chromium, leaving replacement browsers unable to offer similar capabilities.
Ultimately, replacement browser vendors must choose between pursuing their primary mission- trying to close the browser security gap- and ongoing browser development that supports the latest capabilities in leading browsers. And since their development resources are dwarfed by the size of the browser giants, the customer is asked to make a big leap of faith, trading innovation for security, only to wind up with neither.
I just got off a customer call. The customer is using IE-11. We asked why, and the answer was that we have some custom apps that require IE-11. On an earlier customer call, we were talking about Chrome, and the customer said, We have a new application that requires Chrome. We don’t know why it requires Chrome, but it does. A replacement browser cannot be IE-11 – changing the reporting user-agent field works in a few cases, but certainly not for applications designed for a very old browser.
When business requirements outweigh the mandate to universally deploy a replacement browser, then the replacement browser is not covering everything, leaving a general security gap. Worse, unmanaged endpoints, such as contractors, with access to a custom app, can infect it. Also, privileged attackers on unmanaged endpoints could harvest data from the custom app.
The clear alternative to this is cloud-based browser security through the Menlo Cloud, which supports nearly any browser. The proof of this is that our customer mentioned above, using IE-11, is securing it through the Menlo Cloud.
Once again, here we will focus on replacement browsers. Removing browser choice from users can compromise productivity and potentially breed resentment against IT. Now, let’s get one counterpoint out of the way: users are always forced to use something at work: a PC rather than a Mac, a VPN, and, of course, one or more SaaS or desktop apps upon which an organization depends. But… there’s just something about the browser – that we use it on every device, that it’s both a personal and work UI, that it’s the gateway to the Internet — that makes it different.
I do realize that organizational choice will and should override user choice.. But in the absence of such an override, keeping users happy and productive should be on the mind of everyone in the security team.
Among the many considerations on closing the browser security gap that need examination, I think we’ve demonstrated that both organization and user choice may each have ramifications that have to be dealt with, ideally before making any architectural decisions. I hope this discussion about the challenges around both organizational and user browser choice has been helpful.
Menlo Security
