Presented by CloudMosa

Enterprise work now happens increasingly inside the browser, and that shift has made the browser a primary point of entry for cyberattacks as well. Browser-based attacks have surged over the past two years, according to industry reports, while Gartner projects that more than 85% of enterprise workloads will be accessed through the browser by 2027.

And yet most enterprise security architecture is still built to protect the device rather than the browser session where that work, and those attacks, actually take place, says Shioupyn Shen, founder and CEO of CloudMosa, the company behind Puffin Cloud Security.

“CloudMosa originally built its cloud architecture to improve browser performance and accessibility, with the expectation that enterprise work would increasingly move into the browser,” Shen says. “Today’s AI-assisted hacking has validated that architecture, demonstrating that what was designed for performance also provides a strong foundation for modern enterprise security.”

The browser as the enterprise’s operating environment

SaaS platforms, CRM and ERP systems, and collaboration tools have made the browser the primary gateway, and often the central workspace, for enterprise operations. As LLM-powered workflows and autonomous AI agents increasingly operate through that same environment, this shift has also redefined what a threat looks like.

In a device-centric world, security teams could focus much of their attention on endpoints and networks they could monitor, manage and patch on schedule. But because web code now executes locally on the user’s device, every open browser tab can become a potential entry point for malicious scripts, credential theft, supply chain compromise and other browser-based exploits.

The browser now interprets and executes remote code, manages authenticated sessions across enterprise applications, and increasingly serves as the execution layer for AI workflows and agents.

“The browser is no longer just another application running on the endpoint,” Shen says. “In practice, it has become the central operating environment for modern enterprise work. Traditional browsers were never designed to carry this level of enterprise responsibility. They were built as local interpreters of remote code, not as enterprise-grade execution environments with strong isolation and policy enforcement.”

Why detection-first security fails against browser-based attacks

Detection-first security has a timing problem: it typically begins only after risky code has reached the device and started executing inside the browser. Because modern browsers execute dynamic, often obfuscated JavaScript and WebAssembly locally, attacks can act on the device before endpoint tools have time to respond. Short-lived or fileless attacks may steal credentials, exfiltrate data or complete their objective before a security team can intervene.

“It is no longer sufficient to ask only whether a threat can be detected,” Shen says. “The stronger approach is to prevent risky or malicious code from ever reaching the device in the first place.”

AI-generated malware strains signature-based detection

AI is a force multiplier that lets attackers automate the creation, mutation and deployment of malware at a scale signature-based tools were never designed to handle. It can generate large volumes of malware variants and help attackers adapt fileless and browser-delivered techniques faster than defenders can analyze them and update signatures.

That matters because polymorphic malware can alter its code or behavior from one instance to the next, making a known signature less reliable. And when attacks are malware-free — relying instead on legitimate tools, compromised sessions or malicious web content — there may be no conventional file signature to detect at all.

Enterprises have seen an 89% increase in attacks by AI-enabled adversaries over the past year, as increasingly automated and adaptive attacks compress the window available for detection and response.

“Defenders are no longer just chasing more threats, they are chasing a machine that can keep creating new ones,” Shen says. “What was good enough in the past 10 years will not be sufficient in the next six months,” he adds.

Building architecture that removes the attack surface

Rather than continuing to refine detection, the more durable response is to change where web code is allowed to execute in the first place.

“In a conventional browser, the risk comes to the device,” Shen says. “In an isolated cloud model, the risk is kept away from it.”

That principle underlies Puffin Cloud Security. Rather than incrementally improving the browser itself, the platform shifts browser execution into isolated cloud environments. That architectural change improves both performance and security.

The platform runs the original web session, including its JavaScript, WebAssembly, and other executable payloads, inside a disposable cloud environment and streams only a rendered pixel view to the device. Users keep full interactive control over clicking, typing, and scrolling, but the device itself never parses, executes, or stores the original active code.

CloudMosa says display rasterization — the layer responsible for the pixel stream — accounts for roughly 5% of the browser’s total workload, while the more compute-intensive HTML rendering remains isolated in the cloud. As a result, zero-day exploits and AI-generated polymorphic malware have no executable code to run on the endpoint, while fileless attacks or supply chain compromises within SaaS tools remain contained in the cloud.

“In CloudMosa’s view, that means moving from good-enough security on the device to airtight security in the cloud,” Shen says.

Fitting browser isolation into SWG, CASB and ZTNA stacks

Puffin is designed to extend existing security infrastructure rather than replace it. Secure web gateways, cloud access security broker platforms, and zero trust network access tools remain effective at routing traffic, enforcing policy, and controlling access. But none can fully stop local execution once risky content reaches the browser.

Puffin closes that gap by routing high-risk sessions through isolated cloud environments and enforcing browser-level policy, whether a user connects over a VPN, a home network, a managed device or an unmanaged, bring-your-own-device setup.

“Organizations can start with narrow use cases, such as high-risk SaaS access or AI agent workflows, and expand without disrupting tools already in place,” Shen says. “The goal is not to undo existing investments, but to make them more complete.”

The choice between faster detection or endpoint isolation

Detection will always have a role in enterprise security, but the more consequential question is no longer how quickly a threat can be caught, but whether attackers can reach the endpoint at all. Recent 2026 surveys found 92% of security professionals are concerned about the impact of AI agents, with 48% naming agentic AI the top attack vector of the year. Shen noted that agents acting autonomously with user-level privileges are especially exposed to prompt injection, session hijacking, and indirect compromise through compromised web content.

In designing Puffin Cloud Security, CloudMosa has been “paranoid by design,” meaning it invested in an architecture built for worst-case scenarios and for a threat environment where endpoint security and detection alone may not be enough.

“This is not just a philosophy, but something that is reflected directly in the architecture itself,” Shen says. “CloudMosa built earlier for a harsher threat model than most other organizations did, but today’s AI-assisted attacks are now making that posture feel increasingly relevant.”

By dividing a full browser into a very small layer on the device and a much larger layer in the cloud, CloudMosa designed this approach to improve both performance and security at the same time: In Puffin Cloud Security’s architecture, an AI agent’s browser activity takes place inside isolated cloud sandboxes. The endpoint receives only a pixel stream, not the original active code, preventing malicious web content from interacting directly with the device, its credentials or connected systems.

“AI-assisted hacking represents the kind of structural shift that rewards companies willing to rethink browser from the ground up,” Shen says. “And so security leaders now have a choice: redesign for foresight, or wait until hindsight makes the lesson unavoidable.”

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Samsung took a hard look at how people actually use big foldable screens and decided the tall, narrow shape everyone had gotten used to was not the full story. The Galaxy Z Fold8, priced at $1,900 with $350 Amazon GC, arrives with a shorter, wider body that feels closer to a passport than a phone book, and that single change unlocks a far better experience for videos, games, and everything in between.

When you open the cover, you’ll notice a 5.5-inch Dynamic AMOLED 2x panel running at up to 120Hz. With a 10:16 aspect ratio, you can watch vertical clips on Instagram, YouTube Shorts, or TikTok without the awful letterboxing we saw on the Fold Ultra. It also has brightness and a Gorilla Glass Ceramic 3 layer, so no matter how tough you use it, it will not break or become dark on you. Furthermore, its modest size allows you to surf through feeds or answers with just your thumb.

Samsung Galaxy Z Fold8 Unlocked Cell Phone + $350 Gift Card, 256GB, Cream

• PRE-ORDER NOW: Get an Amazon gift card when you pre-order Samsung Galaxy Z Fold8. You will receive an email once your gift card is available after the…
• CREATED FOR YOUR CONTENT: Any way you turn it, the new Galaxy Z Fold8 gives you a fuller viewing experience. Designed with your content in mind, this…
• WORLD’S LIGHTEST FOLD¹: Galaxy Z Fold8 is the newest foldable phone for content on the go. Unfolded, it fits movies and books for an immersive…

When you unfold the device, the main attraction emerges: a 7.6-inch Dynamic LTPO AMOLED 2x screen measuring 1828 by 2448 pixels in a tidy 4:3 ratio. This is also quite bright; 3000 nits at peak brightness is a lot to take in, and the HDR10+ support allows for some very deep blacks and brilliant colors. Plus, with an anti-reflective coating, it may be used outside, and what about the fold crease? Samsung did a much better job at reducing it this time. As you rotate the device, the screen shifts to a 16:10 aspect ratio, comparable to that of a tablet or laptop. So, watching a movie on Netflix or Disney+ does not result in black bars along the sides. Alternatively, if you prefer action games, the larger screen is a significant improvement; no more cramped UI elements or cutscenes.

Along with all that screen real estate, you’ll get some significant power under the hood. The Snapdragon 8 Elite Gen 5 Samsung Galaxy, along with an Adreno 840 graphics processor, performs even the most demanding games with easily, with several reviewers claiming flawless performance even at higher settings. Don’t worry about it being too hot; it does warm up little over a long gaming session, but it recovers quickly. You have 12 GB of RAM, so you can have tons of apps and gaming files simply sitting there ready to go, no need to reload every time, and the stereo speakers do a really nice job of delivering crisp dialogue and some reasonable bass.

As you’d expect, given all that screen time, the battery life is fairly decent as well; according to Samsung, a 4800 mAh dual-cell pack provides up to 26 hours of continuous video playback, and in practice, you can go through a day of streaming, browsing, and small gaming spurts without needing to recharge. Charging it back up is also quick; 45 watts wired puts you over 60% in 30 minutes, but 20 watt wireless gives you a slower top-up. At 201 grams, it’s light enough to handle for hours without tiring, and the folded-up thickness of only 4.5mm makes that large screen feel much less substantial.

By Thyaga Vasudevan, EVP of Product at Skyhigh Security

For decades, enterprise security was largely focused on endpoints and networks. By protecting corporate end-user devices, establishing secure connectivity, and controlling access to on-premises resources, teams could effectively keep their centralized servers secure from intrusion.

Eventually, these priorities evolved as enterprises embraced software-as-a-service (SaaS) models and cloud services, shifting to include new cloud security, data protection, and identity-based controls.

Then employees began working from anywhere, on any device, and the network expanded even further. And if that wasn’t enough, the artificial intelligence (AI) boom came along and made the threat landscape even more complicated.

When users can be in person, remote, or hybrid, and access data from a corporate computer or a personal laptop—then turn around and share that data with third-party AI models—endpoint and network measures alone are no longer sufficient.

Even as enterprise networks become increasingly distributed and complex, there is one common thread that connects users, applications, data, and AI models: the browser. It is the primary interface for modern work, acting as a gateway to business-critical tools, platforms, and more.

Because of this, securing the browser has taken on even more significance, emerging as a critical component of modern security strategies designed to protect data wherever it is accessed—even by AI models.

How AI Revealed an Existing Blind Spot

The excitement around AI has understandably focused enterprise attention on the new risks associated with these models. Security teams worry about employees copying and pasting sensitive information, uploading private files, or inadvertently exposing intellectual property while using AI services and workflows.

Because of this, they focus on protecting sanctioned enterprise AI tools while discouraging the use of unsanctioned shadow AI models, trying to promote adoption while avoiding new threats.

While this is well and good, these growing AI security concerns point to a broader issue that enterprises have long been able to ignore: employees have been moving sensitive data through browser-based applications for years; all AI did was accelerate the volume and visibility of these kinds of interactions.

Think about the everyday actions that take place within a browser session. Users copy and paste information between applications, upload files, download reports, print documents, and share content with partners and collaborators. And this is all done across different devices and locations.

This browser-based activity mirrors much of today’s AI usage, demonstrating that we’re not dealing with an entirely new security challenge, but an evolution of an existing one.

The problem enterprises must now solve is how to govern browser activity effectively without disrupting or greatly inhibiting the user experience.

Why Traditional Security Approaches Are Struggling

The shift to primarily browser-based work has exposed key weaknesses in traditional enterprise security methods. Historically, controls were designed to inspect and secure traffic crossing the network perimeter, or to protect managed corporate devices at network endpoints.

While these methods remain important to overall enterprise security, they were not designed to govern the growing number of user interactions taking place within browser-based applications, services, and models. 

The rise of hybrid work only adds to these challenges. As employees, contractors, and external partners access corporate resources from various devices—both managed and unmanaged—enforcing consistent access and security policies becomes increasingly difficult.

Because of this, enterprises often find themselves with strong protections on company-owned devices, but far less visibility into how data is accessed, shared, or manipulated once it moves beyond managed environments.

AI usage further expands this potential threat landscape, providing additional avenues through which data can quickly and easily leave protected corporate networks. While organizations can restrict access to applications and monitor data as it moves across the network, they still need to govern these kinds of actions that create risk in the first place.

Whether it’s copying sensitive information into an AI prompt, uploading a confidential document to a cloud platform, or downloading proprietary data to a personal device, teams need to find a way to control and manage browser-based activity.

Securing the Browser Without Replacing It

As things stand, enterprises have adopted several different approaches to enhanced browser security. Some choose to deploy entirely new secure browser environments that employees must adopt, while others rely on virtual desktop infrastructure (VDI) or remote browser isolation (RBI) to keep browser activity separated from endpoints.

These methods, while effective, are not perfect. They tend to suffer from deployment complexity, infrastructure overhead, user adoption challenges, and limited coverage for unmanaged devices.

In response to these inefficiencies, a new model has emerged that focuses directly on securing sessions without replacing or largely restricting browsers. These solutions apply inline security controls across common browsers like Chrome, Edge, Safari, and Firefox, allowing organizations to govern user actions within browser sessions without upending existing workflows or inhibiting secure experimentation with new AI models.

Skyhigh Security’s Secure Browser Controls solution is an example of this new, dynamic approach to browser security. Built to work within existing browser and security service edge (SSE) architectures, this solution enables organizations to deter common risk activities, including:

• Controlling copy-and-paste activity involving sensitive data
• Restricting uploads and downloads to sanctioned applications and AI services
• Preventing unauthorized printing or screen capture of sensitive information
• Governing drag-and-drop actions and other methods of data movement between applications
• Applying data protection policies to AI prompts, file uploads, and other browser-based interactions in real time

Protecting Work Where It Happens

As enterprise applications, collaboration tools, and AI services continue to converge inside the browser, security teams must be able to apply controls wherever users interact with data.

Skyhigh Security’s Secure Browser Controls help align security controls with where work is actually happening in enterprise networks, rather than applying them strictly at endpoints and system borders.

The rise of AI may have intensified the conversation around browser security, but the underlying trend extends beyond these newer tools.

By recognizing the browser as a critical control point for enterprise security—and protecting it as such—organizations can ensure their sensitive data is kept safe while supporting browser-based collaboration and innovation.

Request a free a demo of Skyhigh Secure Browser Controls now. 

Sponsored and written by Skyhigh Security.

Nearly £50 off a 2TB drive that reads at 7,250 MB/s isn’t a discount you stumble across every day.

This 2TB Samsung 990 EVO Plus, already considered one of the best SSDs you can buy right now, has dropped from £297.89 to £249.99, a saving of £47.90 that brings serious NVMe speed down to a genuinely reasonable price.