- Remote browser isolation is not obsolete. For unmanaged endpoints and third-party contractor access, it remains the only control that does not require installing anything on the device.
- The real cost of RBI is latency and rendering fidelity, not licensing. DOM mirroring adds less perceptible lag than pixel streaming, but breaks more web applications. Teams rarely discover this during a proof of concept.
- Enterprise browsers solve a different problem: they assume you own the endpoint. RBI assumes you do not. The two controls belong in different parts of your access policy.
- Per-session pricing looks cheap at low volume and gets expensive fast. A workforce with variable browsing intensity will hit cost surprises in the first quarter of production use.
- Garrison is the outlier on the list: hardware-enforced isolation for classified or air-gapped environments, a category no software-only vendor touches.
Remote browser isolation tools work by executing web content on a remote server and sending only a visual representation or sanitized document object model to the end user’s device. The nine platforms compared here span cloud-native pixel streaming, DOM mirroring, clientless access for third parties, and hardware-enforced isolation for high-assurance environments. The right choice depends on whether you control the endpoint, the browsing volume, and the risk category you are isolating.
Why Most Teams Are Framing the RBI Decision Incorrectly
The dominant practitioner opinion right now, visible in any honest Reddit thread or vendor-neutral forum, is that enterprise browsers have made remote browser isolation redundant. That view is half right. Enterprise browsers are a better answer when you control the endpoint and can deploy an agent or a managed browser profile. They offer richer policy controls, better integration with identity providers, and lower latency than most RBI implementations.
RBI wins in one specific scenario: when you cannot touch the endpoint at all. A contractor using a personal laptop. A third-party auditor accessing a sensitive internal tool for two weeks. A manufacturing floor workstation that IT does not own and cannot enroll. In those cases, an enterprise browser is irrelevant because you have no path to install it. A clientless RBI session, accessed through a URL with no agent requirement, is the only isolation you can actually deliver.
The other case where RBI holds is high-risk URL categories. Web mail, newly registered domains, uncategorized sites, and personal cloud storage can be routed through isolation selectively, while the rest of browsing goes direct. That hybrid model preserves performance for trusted destinations while containing the categories that generate the most phishing clicks. This is the architecture most mature deployments run, not blanket isolation of every tab.
What Does Remote Browser Isolation Actually Neutralize?
RBI removes the browser from the attack surface on the local device. JavaScript, drive-by downloads, malicious iframes, and browser exploits execute on the remote server, not on the endpoint. Whatever payload runs in that remote container cannot reach the user’s file system, memory, or credentials stored in the local browser.
What RBI does not neutralize: credential phishing. If a user types their password into a rendered login page, that credential is transmitted from the user’s hands, not the endpoint’s browser. Some vendors add anti-keylogging controls or block form submission on uncategorized sites, but this is a policy layer, not isolation itself. Clipboard control, whether to allow paste from the isolated session into local applications, is a separate policy decision with real usability consequences.
RBI also does not protect against compromised SaaS applications. If the destination is a legitimate, authenticated application that has been tampered with server-side, the isolated browser renders the tampered content faithfully. For browser-delivered malware and drive-by code execution, isolation is a durable control. For data exfiltration through legitimate web sessions, it is not sufficient on its own.
The SecurityOpsWire RBI Friction Index: Measuring the User-Experience Cost Nobody Quantifies
Most RBI evaluations skip user-experience testing. This is how organizations get to deployment and discover that half their web applications break. The SecurityOpsWire RBI Friction Index is a four-dimension framework for assessing the real operational cost before you sign:
Rendering fidelity measures how accurately the isolated session reproduces the original page. Pixel streaming sends a video feed of the remote browser, which preserves fidelity but adds perceptible lag on any connection above 50ms round-trip time. DOM mirroring reconstructs the page locally from a sanitized object model, which is faster but breaks any application relying on non-standard DOM events, canvas rendering, or WebAssembly. Most vendors offer both modes; the question is which is default and how much tuning is required to switch.
File transfer friction measures how painful it is to download a PDF or upload a spreadsheet through an isolated session. Some vendors sandbox downloads automatically, scanning before delivery. Others block transfers entirely by default. The gap between “we support file transfer” in a sales demo and “our finance team can actually work through this” in production is where deals fall apart.
Session startup latency is the delay from clicking a link to seeing a rendered page in isolation. Cloud-based vendors with globally distributed infrastructure measure this in hundreds of milliseconds. Older or on-premises deployments can exceed two seconds per session initiation. For occasional use, acceptable. For a contractor who is browsing eight hours a day through an isolated session, two-second delays on every new tab accumulate into a genuine productivity complaint.
Application compatibility surface measures the percentage of applications in your environment that work without a special whitelist or compatibility mode. Most vendors publish a compatibility matrix but do not test against custom internal applications. Run your highest-traffic web applications through the proof of concept before you commit. WebRTC, video conferencing, and browser-based SSH clients are the most common breakage points.
9 Remote Browser Isolation Tools Compared
1. Menlo Security
Menlo Security built its architecture around what the company calls an Adaptive Clientless Rendering approach, which uses DOM mirroring by default and falls back to pixel streaming for applications that fail the compatibility check. The result is lower average latency than pure pixel-streaming vendors, at the cost of occasional rendering gaps on complex applications.
Menlo’s isolation integrates with existing proxy infrastructure and can be deployed as a standalone cloud service or in front of a Secure Web Gateway. For organizations already running a web proxy, the integration path is shorter than vendors that require a full SASE stack to activate isolation. Clientless access for third parties is supported, making it a reasonable fit for contractor and vendor access use cases.
Menlo does not publish list pricing publicly. Quotes are environment-specific and typically structured around named users or bandwidth tiers. The vendor positions itself at the enterprise end of the market, and the deal size reflects that.
2. Cloudflare Browser Isolation
Cloudflare Browser Isolation uses a Network Vector Rendering approach that transmits drawing commands rather than pixels or DOM objects. Cloudflare’s documentation states this method reduces data transfer compared to pixel streaming and performs comparably to native browsing on its global network. For organizations already using Cloudflare’s Zero Trust or SASE stack, activation is incremental rather than a separate deployment project.
The practical limitation is that Cloudflare’s isolation is tightly coupled to its own proxy and access layers. Teams not on Cloudflare’s network stack will find less flexibility in routing specific URL categories through isolation while leaving others direct. The integration is clean inside the Cloudflare Zero Trust platform and more constrained outside it.
Cloudflare does not publish granular RBI pricing separately from its Zero Trust plans. The Zero Trust pricing page lists a free tier and pay-as-you-go options, but isolation features are available in paid tiers. Check Cloudflare’s current Zero Trust plans for the latest tier structure, as packaging changes frequently.
3. Zscaler Cloud Browser Isolation
Zscaler Cloud Browser Isolation is an add-on to Zscaler Internet Access, the company’s Secure Web Gateway product. For organizations already running ZIA as their primary proxy, adding isolation to specific URL categories is a policy configuration, not a new deployment. That integration advantage is real, and it is the primary reason Zscaler isolation appears in evaluations where the buyer is already in the Zscaler platform.
For teams not on ZIA, Zscaler isolation is not a standalone purchase path. The vendor does not offer RBI outside of the broader platform, which means the entry cost is the full ZIA subscription plus the isolation add-on. Clientless access for third parties is supported through Zscaler Private Access and browser-based access flows. Pricing is not publicly listed; Zscaler quotes per-user or per-organization depending on deal structure.
4. Broadcom / Symantec Web Isolation
Symantec Web Isolation, now part of Broadcom’s enterprise security portfolio, is one of the older isolation products in the market. It integrates with Symantec’s Proxy SG and Web Security Service. For organizations running the Symantec proxy stack, it remains a logical path. For organizations that are not, Broadcom’s enterprise licensing model and support structure make it a difficult evaluation unless you are already a Broadcom enterprise customer.
The product’s maturity means broad application compatibility data exists from years of enterprise deployment. The trade-off is a slower product evolution cycle relative to cloud-native vendors, and Broadcom’s post-acquisition support reputation warrants direct verification before signing a multi-year contract. Pricing is not publicly disclosed.
5. Skyhigh Security Web Security
Skyhigh Security describes itself as an AI-powered, zero trust Security Service Edge platform with unified zero trust access and data security. The platform includes browser isolation capabilities alongside CASB and data loss prevention integration, which matters if web content isolation is one component of a broader SSE consolidation rather than a standalone purchase. Organizations evaluating Skyhigh should confirm directly with the vendor which isolation deployment model, URL category routing, and SWG integration options apply to their specific environment, as the product’s current positioning and feature set should be verified against Skyhigh’s own documentation rather than legacy McAfee Enterprise product descriptions. Pricing is not publicly disclosed.
6. Ericom Shield (positioned within Cradlepoint)
Ericom Shield is positioned within Cradlepoint. Ericom’s historical differentiation was a strong clientless access story: third-party users could access isolated sessions through a URL with no agent, plug-in, or endpoint enrollment. That use case remains relevant for organizations managing large contractor populations.
Buyers should ask directly during evaluation about product roadmap continuity and current support structure. Cradlepoint’s primary business is enterprise 5G wireless WAN and connectivity solutions, which is a different architectural context than browser isolation. Verifying the isolation product’s current capabilities and roadmap commitment before a multi-year commitment is appropriate due diligence. Pricing is not publicly disclosed.
7. Authentic8 Silo
Authentic8 Silo takes a different architectural position than most vendors on this list. Rather than isolating a subset of web traffic through a proxy, Silo is a fully contained cloud browser that replaces local browser use for specific workflows. Users access Silo through a client or browser extension, and all web activity for designated tasks occurs inside Silo’s environment, with no data touching the local device.
This architecture is well-suited to sensitive research workflows: competitive intelligence, open-source intelligence, brand monitoring, or any task where the goal is to access the web without leaving attribution or receiving tracking. Authentic8 markets directly to government and intelligence community customers, and the product has a track record in those environments. For general workforce isolation, the “replace the browser entirely” model creates more adoption friction than selective isolation through an existing proxy. Pricing is not publicly disclosed and is typically structured around seat-based agreements.
8. Garrison Ultra
Garrison is now part of Everfox; the garrison.com domain directs readers to Everfox for current product information. Garrison was historically differentiated by hardware-enforced isolation intended for high-assurance environments , classified government, defense contractors with cross-domain requirements, and critical national infrastructure operators , where the threat model includes adversaries capable of compromising software-only isolation containers. Buyers interested in this capability should contact Everfox directly to confirm current product availability, architecture, and procurement path, as the technical specifications and commercial terms applicable to the Garrison product line should be verified with Everfox rather than assumed from historical descriptions. Pricing has not been publicly disclosed and procurement has historically not followed standard commercial channels.
9. Netskope Cloud Firewall and Intelligent SSE
Netskope includes remote browser isolation as a capability within its Security Service Edge platform, specifically integrated with the Netskope Intelligent SSE and its SWG policies. Similar to Zscaler, isolation in Netskope is not a standalone product. It is a feature available to customers of the broader platform, with policy controls that route high-risk URL categories through isolation while allowing trusted destinations to flow direct.
Netskope’s differentiation relative to Zscaler in the isolation context is its inline CASB and data loss prevention integration, which means isolation policies can be combined with content inspection on files entering and leaving the isolated session. For organizations where data movement through web sessions is the primary risk driver, this integration is operationally meaningful rather than just marketing consolidation. Pricing is not publicly disclosed and is platform-based rather than isolation-specific.
Feature and Architecture Comparison Table
| Vendor | Isolation Method | Clientless Third-Party Access | Standalone Purchase | Best Fit |
|---|---|---|---|---|
| Menlo Security | DOM mirroring / pixel streaming fallback | Yes | Yes | Enterprise, existing proxy environments |
| Cloudflare Browser Isolation | Network Vector Rendering | Yes (via Access) | Only within Cloudflare Zero Trust | Cloudflare-native stacks |
| Zscaler Cloud Browser Isolation | Pixel streaming | Yes (via ZPA) | No (ZIA required) | Existing Zscaler ZIA customers |
| Symantec Web Isolation (Broadcom) | Pixel streaming | Yes | No (Symantec proxy required) | Existing Broadcom/Symantec proxy customers |
| Skyhigh Security | Remote browser (cloud-hosted) | Yes | No (SSE platform required) | Organizations evaluating SSE consolidation |
| Ericom Shield (Cradlepoint) | DOM mirroring / pixel streaming | Yes (strong clientless story) | Yes (historically) | Large contractor/third-party populations |
| Authentic8 Silo | Full cloud browser replacement | No (client or extension required) | Yes | OSINT, research, government workflows |
| Garrison Ultra (now Everfox) | Hardware-enforced (verify with Everfox) | No | Verify with Everfox | Classified / CNI environments |
| Netskope (Intelligent SSE) | Pixel streaming (cloud-hosted) | Yes (via NPA) | No (SSE platform required) | Existing Netskope SSE customers |
Which RBI Tools Support Clientless Access for Third Parties?
Clientless access is the decision criterion that eliminates most enterprise browser alternatives from the third-party access use case. An enterprise browser requires installation. Managed device policies require enrollment. Neither is feasible when the endpoint belongs to a contractor’s employer, a partner firm, or a vendor whose security posture you do not control.
Menlo, Ericom, Zscaler, and Netskope all support some form of clientless access for third parties, where the isolated session is delivered through a standard browser on the unmanaged device with no agent or plug-in required. The user receives a URL, authenticates, and lands in an isolated session with access only to what policy allows. The local device contributes nothing to the session except a screen, a keyboard, and a network connection.
The depth of clientless support varies. Some vendors require a lightweight launcher downloaded at session start. Others are fully agentless from initiation to close. Ask specifically during a proof of concept whether your target contractor scenario, a user on a personal Windows or macOS machine with no pre-installed software, can be onboarded in under five minutes without IT involvement. That test will tell you more than any sales demo.
For teams managing non-human identity sprawl alongside third-party access, the patterns around privileged session management and unmanaged access overlap in interesting ways. The non-human identity security platforms space has developed adjacent controls worth reviewing if your contractor access problem also involves service account or API credential exposure.
How Does Per-Session RBI Pricing Actually Scale?
Most RBI vendors do not publish list pricing, which makes this section harder to quantify than buyers deserve. The pricing models you will encounter in practice fall into three structures:
Named user licensing charges a flat per-seat fee regardless of how much that user actually browses through isolation. This works well for workforces with predictable, high-intensity isolation use. It works poorly if you are isolating only a subset of URL categories, because you are paying for capacity most users will rarely touch.
Concurrent session pricing charges based on the peak number of simultaneous isolated sessions. This can be significantly cheaper for organizations with variable usage patterns, but requires headroom modeling. If you underestimate peak concurrent sessions, you will hit capacity limits at the worst possible time.
Consider a hypothetical scenario. A financial services firm with 800 employees routes web mail and uncategorized URLs through isolation. On average, 15% of users are actively in an isolated session at any given moment, meaning roughly 120 concurrent sessions at peak. At a concurrent session model, that firm pays for 150 sessions of headroom. If a phishing campaign drives unusual traffic spikes where 40% of users simultaneously open suspicious URLs, the firm needs 320 concurrent sessions and will either queue users or overpay for unused headroom the rest of the year. Named user pricing, at 800 seats, removes that uncertainty but costs significantly more at the 15% average utilization.
Platform bundle pricing, which applies to Zscaler, Netskope, Cloudflare, and Skyhigh, means isolation is priced as part of a tier upgrade rather than standalone. The cost per isolated session is often lower here, but only if you were going to buy the platform anyway. Buying a full SASE stack to get RBI when you only need isolation for contractor access is not a cost-efficient path.
Should Isolation Apply to All Browsing or Only a Defined Risk Category?
Blanket isolation of every web session is an architecture that most organizations tried, found expensive and friction-heavy, and scaled back. The performance cost of routing all browsing through a remote browser is measurable, the application compatibility surface is large, and the user experience complaints are immediate.
Selective isolation by URL category is the model that survives contact with production. The most common policy pattern routes newly registered domains (typically registered within the past 30 days), uncategorized sites, web-based personal email, and unapproved cloud storage destinations through isolation. Trusted SaaS applications, known corporate destinations, and vetted partner sites go direct. This hybrid approach contains the highest-risk categories without degrading the experience on the destinations users access most.
A secondary selective model applies isolation by user group rather than URL category. Contractors and third parties get all browsing in isolation. Employees on managed devices browse direct with SWG controls. This approach is clean to manage and easy to explain to auditors, but requires a reliable mechanism to identify and authenticate the user’s group at session initiation, which usually means integration with your identity provider.
The evaluation of which users and which categories to isolate is effectively a risk classification exercise. The same logic applies to how organizations are increasingly thinking about enterprise browser deployment alongside or instead of RBI for managed endpoints, where the policy granularity can be higher because the endpoint is under control.
Where RBI Intersects With Security Operations and Threat Visibility
One underappreciated capability of remote browser isolation is the telemetry it generates. Because all web activity occurs in the vendor’s infrastructure, the vendor can log complete session activity including URLs visited, files transferred, form submissions blocked, and script execution events, without any endpoint agent. For organizations where endpoint visibility is incomplete due to unmanaged devices or BYOD policies, RBI becomes an unexpected source of web activity telemetry that supplements SIEM data.
The question is whether that telemetry gets to where it can be acted on. Most vendors export logs to SIEM platforms through syslog or API. The coverage depends on what the vendor captures and what format it exports. Before finalizing an RBI purchase, map the vendor’s log export format against your SIEM’s ingestion pipeline and confirm that user-level web session data is available for threat hunting, not just aggregate statistics. Teams building detection engineering programs around web-sourced threat signals will find this a meaningful capability gap between vendors.
Security operations teams running detection on web-sourced telemetry should read about how AI-assisted SOC platforms handle web telemetry triage alongside traditional endpoint and network signals.
Frequently Asked Questions About Remote Browser Isolation Tools
What is the difference between remote browser isolation and an enterprise browser?
Remote browser isolation executes web content on a remote server and sends only the rendered output to the user’s device. No code runs locally. An enterprise browser runs locally on a managed endpoint but adds policy controls, session visibility, and data loss prevention within the browser process. RBI does not require touching the endpoint; an enterprise browser does. For unmanaged or contractor devices, RBI is the feasible option. For managed employee endpoints, enterprise browsers often provide a better balance of control and user experience.
Which RBI tools support clientless access with no agent installation?
Menlo Security, Ericom Shield, Zscaler Cloud Browser Isolation (via Zscaler Private Access), and Netskope support clientless third-party access sessions where users connect through a URL with no pre-installed software. The depth of agentless support varies: some require a launcher download at session start while others are fully browser-based from initiation. Testing your specific contractor scenario, a personal device with no pre-existing software, before signing is the only reliable way to verify this claim for a given vendor.
What does RBI actually neutralize versus what it leaves exposed?
RBI neutralizes browser-delivered malware, drive-by download attacks, malicious JavaScript, and browser exploits by executing web content on a remote server rather than the local endpoint. It does not prevent credential phishing, because user keystrokes still originate from the user’s hands. It does not protect against compromised SaaS applications that serve malicious content server-side. Clipboard control and form submission restrictions are policy layers that can be added, but they are separate from the core isolation mechanism.
How does per-session RBI pricing scale for variable workloads?
Named user licensing charges per seat regardless of actual isolation usage, which is predictable but expensive when isolation applies only to a subset of URL categories. Concurrent session pricing charges based on peak simultaneous sessions, which is cheaper at low average utilization but requires headroom modeling to avoid capacity failures at peak. Platform bundle pricing, offered by Zscaler, Netskope, and Cloudflare, embeds isolation in a tier upgrade and is cost-effective only for buyers who need the full platform. Most vendors do not publish list pricing and quote based on environment specifics.
What is DOM mirroring versus pixel streaming in RBI?
Pixel streaming sends a video feed of the remote browser to the user, preserving visual fidelity but consuming bandwidth and adding latency proportional to network round-trip time. DOM mirroring reconstructs the page locally from a sanitized document object model, which is faster but breaks applications that depend on non-standard DOM events, WebAssembly, or canvas rendering. Most enterprise RBI vendors support both modes. DOM mirroring is better for performance on standard web applications; pixel streaming is the safer fallback for complex or custom applications.
Is RBI appropriate for all browsing or only high-risk URL categories?
Blanket isolation of all web sessions creates measurable latency, significant application compatibility challenges, and high user friction. Most production deployments use selective isolation, routing high-risk categories such as newly registered domains, uncategorized sites, and personal web mail through isolation while allowing trusted destinations to go direct through a Secure Web Gateway. A second model isolates all browsing for specific user groups, typically contractors and third parties on unmanaged devices, while allowing managed employees to browse direct with SWG controls.
Can Zscaler provide remote browser isolation?
Yes. Zscaler Cloud Browser Isolation is available as an add-on to Zscaler Internet Access, the company’s Secure Web Gateway product. It is not available as a standalone purchase outside the ZIA platform. For organizations already running ZIA, adding isolation to specific URL categories is a policy configuration change rather than a new deployment. For organizations not on the Zscaler platform, the entry cost is the full ZIA subscription plus the isolation add-on, which changes the economics significantly compared to standalone RBI vendors.
What makes Garrison Ultra different from software-based RBI tools?
Garrison Ultra was historically differentiated by hardware-enforced isolation designed for high-assurance environments , classified government, defense contractors, and critical national infrastructure operators , addressing the threat model of adversaries capable of compromising software isolation containers. Garrison is now part of Everfox. Buyers should contact Everfox directly to confirm current product capabilities, availability, and procurement path. For standard enterprise use cases, software-based RBI from vendors like Menlo, Cloudflare, or Zscaler is sufficient.
How to Decide: A Practical RBI Selection Framework
The most common mistake in RBI evaluations is treating isolation as a binary decision. The useful question is not “should we deploy RBI” but “which access scenarios in our environment cannot be covered by controls that require touching the endpoint.” If that list is empty, meaning you own and manage every device that accesses sensitive systems, an enterprise browser or SWG with advanced threat protection may be sufficient. If that list includes contractors, vendors, personal devices under BYOD policies, or manufacturing or operational technology assets IT does not control, isolation belongs in your access policy for those specific scenarios.
Architectural fit with your existing stack matters more than individual feature comparisons. If you are running Zscaler ZIA today, Zscaler isolation is the lowest-friction path and the commercial relationship is already in place. If you are Cloudflare-native, the same logic applies. If you are not committed to a SASE platform and are evaluating isolation as a standalone control, Menlo is the most mature standalone vendor in this market for enterprise scale, with Ericom as a credible alternative particularly for clientless contractor access.
The latency and rendering fidelity dimensions of the SecurityOpsWire RBI Friction Index are where evaluations fail most often. Run your fifteen most-used web applications through the vendor’s environment before you sign. Test clipboard controls against your specific workflow requirements. Test file download and upload with the file types your users actually handle. A proof of concept that covers only vendor-selected demo applications and a curated URL list will not predict production behavior. The friction you discover during a real pilot is the friction your users will file tickets about on day thirty.
Teams investing in broader security program architecture alongside RBI, particularly around AI agent access to web content and external resources, will find adjacent context in how AI agent security platforms handle external content access, where similar isolation and containment principles apply to non-human browsing behavior.
