We were surprised by the approach taken by Menlo Security in its State of Browser Security Threat Report from June 2026. We were anticipating market research data from a survey of organizations. What’s presented, however, is threat data from Menlo’s data sources plus reference to other research reports that contain complementary perspectives and corroborating data points. It’s not a bad difference; just not what we were expecting.
It’s a report that takes several hours to read and digest properly. The line of argument goes like this:
- A lot of work processes happen within the browser – e.g., app access, email, AI. Menlo calls the browser the “enterprise operating system” and says it’s the “most consequential attack surface in the enterprise.”
- Most security tools within organizations can see some things about browsers, but most miss the important things that happen during browser sessions. Attacks that happen at the session layer are invisible to current security tools.
- Security tools that assess sites / domains based on reputation often struggle (fail) to detect attacks hosted on reputable infrastructure, e.g., Microsoft 365, Google
- Patching deals with code vulnerabilities in browsers, but it’s a structural impossibility to protect browsers that execute locally from real-time attacks that happen between the disclosure of a vulnerability and the deployment of the fix. You just can’t do it.
- Organizations need the ability to see what’s happening in real-time in a browser session in order to stop / block / prevent threats from landing, plus the confidence that if a threat is detonated, that the endpoint won’t be compromised.
- AI agents amplify / escalate the threat when session-based controls are lacking.
- Modern attackers are clever; they’re designing attacks that account for and bypass the dominant security tools – secure web gateways, EDRs, and the email gateway.
- Menlo offers a Secure Enterprise Browser solution that offers a session-based security model combined with remote execution / cloud isolation so endpoints aren’t at threat of compromise. A session-based model is essential because it enables analysis of intent in real-time not just declared / knowable attributes of the content, domain, or infrastructure.
In a future iteration, survey data from organizations would offer a worthwhile set of complementary data perspectives, especially around security confidence (or lack thereof), plans for next-gen tooling, incident awareness, and more.