Glossary · simply explained

Remote Browser Isolation (RBI)

Browser isolation runs websites in the cloud instead of on the device — malicious code stays out, phishing comes to nothing.

Remote browser isolation (RBI) moves the execution of websites from the endpoint into an isolated cloud environment: the page runs in a sealed-off remote browser, and the device only receives the rendered, harmless output. Even if a page carries malicious code, it never executes on the device.

Browser isolation applies the Zero Trust principle to browsing: no website is trusted — the only question is where it runs. For browser security this is a change of architecture, not just another filter — a zero trust browser session by default.

How does browser isolation work?

When a page is opened, the platform spins up an isolated browser in the cloud — close to the user, as a disposable instance. Only a safe stream of rendered content reaches the device; modern approaches transmit drawing commands instead of video, so the page feels smooth and native. When the session ends, the instance is discarded together with everything the page loaded.

Web isolation is policy-driven: downloads, uploads, copy-and-paste and keyboard input can be allowed, restricted or blocked per site category. RBI should be distinguished from an enterprise browser — a managed local special-purpose browser: with cloud browser isolation, users keep their familiar browser and only the execution location moves.

When is remote browser isolation worth it?

The strongest lever is phishing protection: links from emails can always be opened in isolation — read-only when suspicious, so no credentials can be entered on the fake login page at all. New and uncategorised domains, which a secure web gateway would otherwise have to block or allow, get a third, better option: open isolated.

The second big case is unmanaged devices: contractors, partners or BYOD access corporate web apps through an isolated browser — no agent on the device, full control over data and downloads. In an SSE platform, the SWG policy automatically decides when a session moves into isolation.

Typical scenarios

Always open links from emails in isolation — phishing pages stay harmless.
Open new and uncategorised domains isolated instead of blocking them outright.
Administrators and privileged users browse in the remote browser by default.
BYOD and externals: clientless access to web apps with download control.
Risky file types are sanitised first, then released for download.

Frequently asked questions about Remote Browser Isolation (RBI)

Do users notice a difference when browsing through RBI?

With modern browser isolation, hardly: instead of video, current platforms stream the page’s drawing commands, so scrolling and typing feel native. Sensibly configured, only the risky share of traffic runs isolated anyway — new domains or links from emails, not the entire web.

Does remote browser isolation replace endpoint protection?

No, they complement each other: RBI prevents web-borne malicious code from ever reaching the device — EDR remains responsible for everything arriving by other routes, from USB to email attachments. Together with SWG and DLP this creates layered protection for a secure browser workday.

What distinguishes RBI from an enterprise browser?

The execution location. Remote browser isolation runs pages in the cloud and users keep their familiar browser. An enterprise browser is a managed special-purpose browser on the device itself. Both paths lead to a secure browser — RBI works without switching software and usually without an agent.

Is browser isolation part of SASE/SSE?

Yes — RBI is one of the building blocks of SASE and SSE, alongside SWG, CASB and DLP. The platform advantage: the SWG policy automatically decides which sessions run isolated, and identity, device posture and logs are the same as in the rest of the Zero Trust stack.

Does RBI help against phishing?

Yes, very directly: suspicious links open read-only in isolated mode — no credentials can be typed into the fake login page. The theft comes to nothing before awareness training or filters even need to kick in.