Menlo Security today unfurled a software-as-a-service (SaaS) platform that makes it simpler to centrally apply and manage cybersecurity policies to secure instances of Google Chrome or Microsoft Edge browsers.

Andrew Harding, vice president of security strategy for Menlo Security, said the Secure Enterprise Browser platform provides organizations with the ability to centrally manage Menlo Secure Cloud Browser, a framework that isolates and filters browser traffic in the cloud. That zero-trust approach prevents any cyberattack aimed at a browser from actually reaching the endpoint being used to access Menlo Secure Cloud Browser, noted Harding.

Rather than requiring end users to replace their favorite browser, Menlo Security has been making a case for improving endpoint security by offloading web access requests to a cloud service. That service removes malware and phishing attacks before passing that traffic on to an endpoint running either Google Chrome or Microsoft Edge browsers an organization has standardized on.

That approach provides the added benefit of eliminating the need for IT teams to manage SSL/TLS certificates for every browser, noted Harding.

Menlo Security is also adding posture management capabilities to assess browser configurations as settings change every time an update is made to a browser. There is also a data loss prevention (DLP) capability that extends copy-paste controls, user-input limits, watermarking and data masking to each endpoint.

Finally, Menlo Security is adding the ability to apply a Menlo Browser Extension to unmanaged devices via a self-service deployment option. The Menlo Security Client already enables cloud-based access to legacy web browsers that require support for secure socket shell (SSH) or the remote desktop protocol (RDP).

Menlo Security claims its browser security platform is already being employed by approximately eight million users across nearly 1,000 global enterprises and government organizations, including the U.S. Department of Defense (DoD). Each organization will naturally need to decide to what degree they want to centralize web access, but as IT environments become more distributed, it becomes more challenging to secure the attack surface. Most of the attacks targeting those surfaces involve some attempt to exploit a browser to access corporate resources, noted Harding.

The challenge organizations frequently encounter is that while cybersecurity teams may define the policies governing access, it’s usually up to IT operations teams to ensure they are enforced. Secure Enterprise Browser provides a platform through which those teams will be able to more easily collaborate, added Harding.

Of course, there are still a lot more organizations attempting to secure individual endpoints, but given the chronic shortage of cybersecurity expertise, another approach is likely required. Many employees are already using multiple machines running different browsers to access corporate resources. It’s not possible for a small cybersecurity team to ensure that each of the browsers running on those devices is secure without centralizing how those browsers access the web.

The challenge is finding a way to achieve that goal without alienating end users who often have strong browser preferences. The trouble with end users, as always, is that while they acknowledge cybersecurity is an issue, it doesn’t always follow that they are willing to be inconvenienced to achieve it.