Surface is an on-premises browser security platform that protects enterprises from identity, data, and action-based threats directly inside the browser tab. It detects and blocks AitM phishing, session theft, malicious extensions, and risky AI behavior without requiring browser replacement, proxy latency, or a vendor cloud. The platform deploys as a lightweight extension managed via group policy or MDM, with all data and models remaining within the customer's perimeter.
Funding
Funding not disclosed
Founders
Product
Problem
Email gateways stop at the inbox and EDR stops at the OS, leaving the browser—where credentials, redirects, extensions, and AI agents operate—as a largely unguarded attack surface. With 70% of malware now browser-based and under 10% of enterprises having deployed any browser security, organizations face significant exposure to AitM phishing, session theft, and malicious extensions.
Solution
Surface provides an on-premises browser firewall that lives inside the tab, protecting identity, data, and action without replacing the browser or introducing proxy latency. The platform uses adaptive page-level vision to catch zero-day phishing kits, multi-plane deception to detect stolen session replay, and policy-grade DLP to govern data movement and AI behavior. Deployed as a lightweight extension managed via group policy or MDM, Surface correlates every browser event into forensic-grade timelines and pushes enriched alerts to existing SIEM/SOAR workflows, all while maintaining zero cloud dependency and full data residency.
Target Audience
Primary customers are enterprise security teams in finance, healthcare, government, and critical infrastructure that require sovereign deployment and full data residency for browser security, as well as SOC teams needing forensic-grade visibility into browser-based attacks.
Features
- Surface Vision: adaptive, on-device page-level analysis fusing DOM structure, OCR, perceptual hashing, and brand intent into a single verdict in under one second
- Shadow Sessions: multi-plane decoy tokens, cookies, API keys, and extensions that trigger immediate alerts when touched by attacker tooling, with near-zero false positives
- Agentic AI security: prompt-injection detection, origin-pinned credentials, and action-level governance for browser-based AI agents
- Named coverage for 18 attack techniques including AitM/Evilginx, ClickFix, Browser-in-the-Browser, OAuth consent abuse, device-code phishing, and HTML smuggling
- Visual policy builder with context-aware actions (block, warn, log, allow) scoped by department or role, plus real-time policy hit monitoring
- Step-up identity verification with out-of-band codes and SOC analyst approval workflows for high-risk actions, backed by immutable on-prem audit trails
- Automatic shadow IT discovery with risk scoring across sanctioned and unsanctioned apps, including department-level attribution
- Custom rule engine for modeling org-specific tradecraft, with full session reconstruction and one-click SIEM export