For most small businesses the browser is the workplace: email, accounting, banking and customer data all load in it. A secure setup means managed updates, controlled extensions, strong sign-in and separation of work and personal profiles. You can get most of the benefit from settings, without buying a special product.
Why is the browser the main target?
Because that is where the work happens and where credentials are typed. CISA's Cyber Essentials, written for small organizations and government, tells leaders to learn about risks like phishing and business email compromise, and says to use email and web browser security settings to protect against spoofed or modified emails and unsecured web pages. The browser sits at the intersection of those two threats.
"Enterprise browser" is a market term and not a standard. The same goals can often be met with ordinary browser management policies, an identity provider and good habits. Judge any product on which of these controls it gives you.
What controls matter most?
Updates. CISA says to use automatic updates for all operating systems and third-party software, and to enable them whenever possible. Browsers are a prime target for exploits, and an unpatched one is among the easiest ways in. Set automatic updates and check that they are working.
Multi-factor authentication. CISA says to require MFA for access to your systems whenever possible, starting with privileged, administrative and remote access users. For browser-based apps, MFA at the identity provider protects every app behind it. NIST's authentication guidance (SP 800-63B-4) favors phishing-resistant methods, which matters because the browser is where phishing pages load.
Extensions. Extensions can read pages, including those with sensitive data. Allow a short approved list, block the rest, and review them periodically. An extension that changes owners or asks for new permissions deserves a second look.
Password handling. Use a password manager that fills only on the correct domain. It helps in a small way against phishing, since a fake domain gets no fill.
Profiles. Keep work and personal browsing in separate profiles, so personal extensions and sessions do not touch work data.
Safe browsing and download protections. Keep the built-in warnings on. Block installing software from the internet on work devices where you can.
Device basics. Disk encryption, screen lock and a way to wipe a lost device.
What about unmanaged and personal devices?
Many small businesses allow personal devices. NIST SP 800-207 on zero trust notes that no trust should come merely from device ownership or network location, and that access decisions should consider the requester and device. In practice: for unmanaged devices, allow access only to web apps, with MFA, and no local download of sensitive files.
A constructed example
A ten-person accounting firm has staff using personal laptops and whatever browser they like. The owner sets up a single identity provider with MFA for all apps, using hardware keys for the two partners. She sets managed browser policies on the firm's laptops: automatic updates, an approved extension list of five, a work profile, and the password manager as the only manager allowed. For personal devices she allows web access only and blocks file download from the client portal. Over the next quarter, a staff member clicks a fake document link; the password manager does not fill on the lookalike domain, and the user notices.
How to check or apply this
- Make a list of browsers and versions in use, and turn on automatic updates.
- Put all web apps behind one identity provider with MFA.
- Create an approved extension list and block everything else.
- Deploy a password manager and ask staff to use it for all work sites.
- Separate work and personal profiles.
- Decide what personal devices may and may not do.
- Train staff on phishing with examples from your own inbox, and make reporting easy.
- Review settings every six months.
Quick check
Do I need a special enterprise browser product?
Not necessarily. Many of the controls come from standard browser policies and an identity provider. Evaluate any product against the specific controls you need.
What is the single most useful step?
Turn on MFA for email and other core apps, then keep browsers updated automatically. CISA lists both among its basic actions.
Sources
- CISA Cyber Essentials
- CISA, More than a Password
- NIST SP 800-63B-4, Authentication and Authenticator Management
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
