Key Capabilities
In-browser security features
These controls run natively within the browser on the user’s device, before traffic reaches the network:
Capability | Description |
|---|---|
Browser controls | Granular allow/block policies for copy, paste, print, watermarking, screenshot and screen sharing, scoped to specific destinations |
Browser configuration | Centrally manage browser settings — password managers, developer tools, browsing history — to enforce a hardened posture |
Extension governance | Control which browser extensions can be installed; prevent unapproved or malicious add-ons from accessing corporate data |
Device classification | Native posture checks (OS version, disk encryption, security software…) to verify device health before granting access |
Netskope NewEdge enforcement
All browser traffic flows through Netskope NewEdge for cloud-delivered inspection:
Capability | Description |
|---|---|
SWG / CASB / DLP | Real-time SSL inspection, content filtering, SaaS visibility and control, and data loss prevention across all HTTPS traffic |
Threat protection | Block malicious sites, phishing, and malware delivered via the browser |
Private Access (ZTNA) | Secure, browser-based access to internal applications without a VPN |
GenAI & SaaS AI controls | Visibility and control over AI application usage and data inputs across GenAI tools and SaaS AI features |
Unified policy engine | Uses the same policies defined in the Netskope One console — consistent protection across managed and unmanaged devices |
How Enterprise Browser Differs from a Consumer Browser
Enterprise Browser | Consumer browser | |
|---|---|---|
Traffic inspection | All HTTPS traffic routed through Netskope NewEdge | None |
Policy enforcement | Centrally managed via Netskope One console | None |
Data controls | Copy, paste, print, watermarking, screenshot controls scoped per destination | Not available |
Private app access | Built-in, policy-controlled via ZTNA | Requires VPN or separate solution |
DLP | Integrated | Not available |
Extension control | Admin-governed allowlist | User-managed |
Device posture | Native posture checks at authentication, continuously re-evaluated throughout the browsing session | None |
Identity | Tied to corporate SSO | Personal account |
Value for Administrators
Enterprise Browser gives IT and security teams full visibility and control over browser activity across the entire workforce — including contractors, partners, and employees on personal devices — without deploying a VPN client or requiring MDM enrollment.
What admins gain:
- A single console (Netskope One) to author and enforce browser security policies across managed and unmanaged devices
- Granular browser controls scoped by destination, user group, or device posture — not just allow/block at the network level
- Consistent DLP and threat enforcement for users who were previously outside the security perimeter (BYOD, contractors, remote workers)
- Native ZTNA-based private app access that replaces legacy VPN for browser-based workflows
- Visibility into GenAI and SaaS AI tool usage across the workforce, leveraging Netskope AI Security products and features
Deployment model: Admins have two installation paths depending on the device type. On managed corporate devices, Enterprise Browser can be silently deployed and configured via MDM — no user action required. On unmanaged or BYOD devices, users perform a self-service installation using an email invitation and license key provided by their IT team.
Value for End Users
Enterprise Browser looks and works like the browser users already know, with a dedicated work
profile that keeps corporate and personal browsing separate.
What users experience:
- A familiar Chromium browser — no new interface to learn
- A dedicated work profile with a homepage showing their company’s applications
- Inline notifications when an action is restricted — users are coached about why the action is blocked and, where configured, given the option to justify their need to access a site or perform a specific action
- Secure access to internal applications without a VPN client
- Optional visual watermarks on sensitive pages (configured by IT)
Getting started: The experience depends on how Enterprise Browser was deployed. On managed devices where IT has deployed Enterprise Browser via MDM, users simply open the browser and authenticate with their corporate SSO credentials — no setup steps required. On unmanaged or BYOD devices, users install Enterprise Browser from the link in their IT invitation email, create a profile using the provided license key, and sign in with their company SSO credentials. No proxy settings or VPN configuration is required in either case.
Supported Platforms
Platform | Support |
|---|---|
Windows | ✓ |
macOS | ✓ |
iOS | ✓ |
iPadOS | ✓ |
Android | ✓ |
ChromeOS | ✓ |
Prerequisites
Before deploying Enterprise Browser:
- A Netskope One tenant with Enterprise Browser licensed
- A SAML 2.0 or OIDC-compliant identity provider (Okta, Microsoft Entra, PingIdentity, or any SAML 2.0 or OIDC-compliant IdP)
- Users imported and provisioned in your Netskope One tenant
To learn more: Enterprise Browser Platform Support Matrix for the full requirements checklist
Considerations
- Enterprise Browser steers HTTPS traffic, including browser-based access to private applications (web, SSH, RDP). Other protocols (e.g. HTTP) and non-HTTP traffic are not supported.
- Browser-bypassed connections do not receive policy evaluation
- Enterprise Browser cannot be used to access applications routed through China PoPs
To learn more: Enterprise Browser Considerations for the full list