By Byron V. Acohido
Nobody picked the browser to run the workplace. It just happened.
Related: The year of the enterprise browser
HTML5 matured. SaaS spread. One business application after another moved into a tool designed to browse the public internet. Security and privacy problems followed. AI has made the arrangement harder to govern.
The cybersecurity industry is now scrambling in different directions. Some vendors replace Chrome or Edge with a hardened enterprise browser. Others add extensions or runtime controls to the browsers employees already use. A third approach treats the browser as the workplace itself.
The numbers show why the choice has become urgent. Verizon’s 2026 Data Breach Investigations Report found regular AI use on corporate devices jumped from 15 percent to 45 percent in one year; 67 percent of those users accessed AI through noncorporate accounts. An Omdia survey sponsored in part by Parallels found 55 percent of 400 North American IT and security professionals said their organizations experienced a browser-related attack or security incident in the preceding year.
HERE Enterprise CEO Mazy Dar flips the usual sequence. His company begins with productivity: separate work applications from public browsing, rebuild the work side around connected workflows, and govern that space by design rather than by later addition.
I sat down with Dar at Black Hat USA 2026 in Las Vegas. For a full drill-down, please give the accompanying Fireside Chat podcast a listen. Here is what I took away from the conversation.
How work moved in
The change began around 2010. HTML5 gave web applications the richness once reserved for software written in .NET, Java, Flash or Silverlight. Google’s Chromium engine supplied enough speed for sophisticated applications. Salesforce and the wider SaaS market delivered more of them through the browser.
The browser interface barely changed as the workload did. Employees accumulated rows of tabs, toggled among applications and re-entered the same information. A wealth adviser might keep a client list in Salesforce, portfolios in a second system and market data in a third.
The adviser toggles through the tabs and rekeys the client information during the call. Every tab stands alone. None of them can tell the others what the user just did.
The same design carries a second cost. Those work tabs sit alongside whatever else the employee opens, in the same browser profile, sharing cookies, saved credentials and every extension the user has installed. Chrome and Edge keep individual sites in separate processes. Neither one marks off the work applications as a space to be governed.
That gap matters more than it used to, because many browser attacks never arrive as a download at all. They run inside the live session. A malicious extension reads what the user reads. An injected script pulls session tokens and rides an authenticated login into a work application. Credential harvesting happens on a page that looks exactly like the real one.
When nothing touches disk endpoint tools looking for files and processes can miss it entirely.
AI raises the stakes again. An AI assistant working in the browser reads the open page and acts on what it finds, so a hostile page in one tab can feed instructions to something with access to the work tabs.
The plainer version is already routine. Employees copy confidential information out of internal applications and paste it into AI accounts their employer does not control. Dar said that used to be an operational risk and is now orders of magnitude larger.
“The browser was never designed to be a workspace,” Dar said.
Dar’s company, then called OpenFin, went at the first problem in 2011. It used Chromium, the same engine inside Chrome, to run bank applications side by side in one window. Then it added interoperability: the applications could send messages to each other. Click a client name in one panel, and the portfolio and market-data panels updated themselves. Large banks built trading and wealth-management desktops on that runtime, and the toggling and rekeying went away.
Two camps, one gap
The security market responded after work had already moved. One camp built new browsers around containment and policy enforcement. Island pioneered the category, and Palo Alto Networks followed with its Prisma Access Browser, built on the Talon technology it acquired in 2023. Netskope and Check Point have since shipped their own. The pitch is a browser the company controls end to end.
A second camp left Chrome and Edge in place and instrumented them with extensions or runtime agents. The money has gone heavily this way. CrowdStrike closed its roughly $420 million purchase of Seraphic Security on Feb. 3, buying technology that runs inside Chrome, Edge, Safari and Firefox rather than replacing them. Zscaler closed its acquisition of extension maker SquareX two days later. Akamai paid approximately $205 million for LayerX, another extension maker, closing that transaction July 2. Three deals in six months, all of them bets that companies would rather harden the browser they have than adopt a new one.
Both camps add real controls. Neither one separates work from the public internet. Dar says they preserve an interface designed for public browsing and, in most cases, leave trusted work applications running alongside untrusted websites.
Two browsers, two jobs
Dar advocates two browsers with separate jobs. Run work applications inside HERE. Use Chrome, Edge or another enterprise browser for the public internet. A company can secure that second browser as aggressively as it chooses.
The separation narrows the security problem. Public websites no longer share the work environment with applications containing confidential data. The work side gains a defined set of users, applications, data flows and approved AI services to govern, and the controls sit inside that environment rather than over a browser built for everything.
Microsoft has built a limited form of this separation into Edge for Business. An employee signed in with both a work account and a personal account gets two separate browser windows, each with its own cookies, cache and history. When automatic profile switching is turned on, Edge decides which window a link belongs in. A Salesforce page goes to the work side. A shopping site goes to the other.
Edge stops there. It separates browsing sessions, not applications, and it does nothing about toggling or rekeying. But Microsoft has the second-largest share of the browser market and a competing product to sell, and it has arrived at the same starting point he did: work and the public internet do not belong in the same browser.
Inside the work side
HERE remains a Chromium-based enterprise browser. Its distinction begins with the work interface. Supertabs carry the 2011 runtime forward: a user drags several applications into one dashboard, and those applications exchange context through an interoperability layer the company calls Signals. Data loss prevention, application isolation and audit logging run in that same layer. The governance and the interoperability are one piece of engineering rather than two.
HERE Studio applies the same idea to building. Non-technical employees in regulated industries can now build work applications that support their everyday tasks and make them more productive. Studio assembles them on top of Salesforce, email, internal APIs or other systems of record, using only the organization’s approved AI model, approved data and approved design system. HERE calls the result compliant by construction, and says the finished interface conforms to its interoperability, accessibility, design and compliance requirements.
Whose default wins
HERE has also adopted part of the extension approach. A partnership announced July 28 integrates Keep Aware’s browser-native threat detection, behavioral analytics and data loss prevention into HERE. Dar said the same Keep Aware extension can protect Chrome and Edge on the public-browsing side.
The resulting product crosses the market categories: an enterprise browser organized around productivity, with governance built into the workspace layer and a partner’s detection technology integrated on top.
Every company already sits somewhere on this map and must commit to a direction. The browser is carrying the workplace, and in an environment this unsettled, the boundary has to be established deliberately.
I’ll keep watch and keep reporting.
Acohido
Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.
(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All interviews, analysis, fact-checking, and final writing are my own. I remain responsible for every claim and conclusion.)
