Ask a small business how it’s protected, and the answer is usually an email filter, antivirus and MFA. They all still matter. But many attacks now reach staff another way: in the browser, where none of them look.
Attacks you may already have seen
- “Press Win+R and paste.” A fake CAPTCHA or error page puts a command on the clipboard and asks the user to run it. This is ClickFix.
- An invoice that’s really a program. A download, often inside a ZIP, that installs a remote access tool. See dangerous downloads.
- A file the page builds itself. The email holds only a link, and the web page assembles the file. This is HTML smuggling.
- A code on Microsoft’s real website. The user enters a code at microsoft.com/devicelogin and signs the attacker in, MFA and all. This is device code phishing.
- Work files in the wrong place. Customer details pasted into an AI tool, or uploaded to personal storage.
They have one thing in common. The email, if there is one, holds nothing harmful. The harm happens when the user clicks, downloads, pastes or signs in, in the browser.
What browser security means
Browser security is protection that works inside the browser, at the moment the user acts. It can:
- stop a dangerous download before it’s saved;
- block a website or a page, or warn before it opens;
- keep a malicious command off the clipboard;
- control which files go to which websites;
- tell the user why, in your words.
Email filters see the message. Antivirus sees files once they’re on the computer. Browser security sees what happens on the web page, which neither of them can.
What Chrome and Edge already do
Start with what you have. It’s free, and it matters.
- Google Safe Browsing and Microsoft Defender SmartScreen warn about known malicious websites and downloads. Keep them on, and stop users turning them off with browser policy. They work by reputation, so a new page or file can get through before it’s known.
- Browser policies from Intune, Group Policy or Google Admin can block websites, restrict downloads and control extensions. They’re all or nothing: a website is blocked or it isn’t, users see a generic error page, and nothing records what was stopped.
- Conditional Access, in Microsoft 365 Business Premium, can block device code sign-in on every device.
The names you may hear
Browser security is a new idea to most small businesses, and the tools go by different names:
- Enterprise browsers replace Chrome and Edge with a browser the company controls.
- Browser detection and response detects threats in the browser, such as phishing pages, and alerts a security team.
- Data loss prevention (DLP), such as Microsoft Purview and Chrome Enterprise Premium, controls sensitive data with labels and content rules.
Most were built for larger organisations with a security team to run them. With 10 to 250 staff and no security team, the question is simpler: what stops the common attacks, with little to set up?
A fair question: can you trust it?
Any browser tool you install can see a great deal of what staff do online. That visibility is the point for a security team watching for threats. For a small business, how little a tool needs to see matters just as much.
So it’s fair to ask of anything that sits in the browser: what does it actually read, and where does that go? Look for a tool that checks on the computer, reads only what a rule acts on, never reads what people type, and uploads nothing to be checked elsewhere.
Where Browser Rules fits
Browser Rules is a browser security extension for businesses without a security team, and the MSPs that look after them. It works in the Chrome and Edge your staff already use.
- On from install. Default policies block dangerous downloads, ClickFix commands and Microsoft device code sign-in. ZIPs are checked inside.
- Your rules, in one console. Block, warn about or allow websites, downloads, uploads and clipboard use, for everyone or for a group.
- Your message to the user, at the moment it matters, so a block teaches something.
- An audit log of what was blocked or warned about, in the detail you choose.
- Private by design. Checks run in the browser. It reads only what a policy acts on, never what people type, and uploads nothing. The console records only what your policies act on, in the detail you choose.
- Free for up to 50 users, with every protection included.
It works alongside Safe Browsing, SmartScreen, Conditional Access, your email filter and antivirus. It doesn’t replace any of them.
What Browser Rules doesn’t do
- Spot fake sign-in pages. It doesn’t judge a page by its content. Safe Browsing, SmartScreen and phishing-resistant MFA, such as passkeys, cover that.
- Scan files for malware. It judges downloads by file type. Antivirus checks what’s inside.
- Cover other browsers or devices. It protects Chrome and Edge where it’s installed, not Firefox, Safari or phones.
- Investigate incidents. It has no session recording or forensics. It records what its policies act on.
A simple setup for a small business
- Keep Safe Browsing or SmartScreen on, set by browser policy so users can’t turn it off.
- Allow only the browser extensions you approve.
- Use phishing-resistant MFA everywhere, such as passkeys. With Business Premium, block device code sign-in with Conditional Access.
- Add browser security for what those miss: dangerous downloads, ClickFix commands and where work files go.
- Show users a clear message when something is blocked, so they learn from it.
See it for yourself
Install Browser Rules from the Chrome Web Store, or deploy it with Intune, Group Policy or Google Admin. Then download the test file on that computer. Browser Rules blocks it, and the block appears in your audit log.