Push Security

Where Push Security sits

Push Security takes an unusual position in the security market: instead of protecting the network, the endpoint, or the inbox, it protects the browser — specifically, the moment where an employee's identity meets a SaaS application. The company is built by red team and blue team practitioners and sells a single browser extension that collects high-fidelity telemetry about what happens where work actually occurs, detects identity attacks in real time, and gives security teams controls that act inside the browser. It has grown quickly: a $30M Series B funds the expansion, and named customers on the pricing page include Sophos, GitLab, Cribl, GreyNoise, Ramp, Upvest and Thinkst — a customer list that skews technical, which is itself a signal about who validates this product.

The thesis is that the identity layer is the real perimeter now. Employees authenticate to dozens of SaaS apps through a browser; credentials live in that browser; session cookies live in that browser; and attacks like adversary-in-the-middle phishing, session hijacking and Browser-in-the-Browser spoofing happen there, invisible to email gateways and endpoint agents. Push watches that layer directly.

What it actually does

The capability list on pushsecurity.com/pricing is unusually concrete for a security vendor. Threat detection covers AitM/reverse-proxy phishing, cloned login pages, Browser-in-the-Browser and Browser-in-the-Middle attacks, ClickFix/clipboard injection blocking, and session hijacking detection, with configurable response modes — monitor, warn, or block — URL blocking, custom detection rules, screenshot capture on detection events, and mail forwarding rule monitoring for Microsoft 365 and Google. Credential security is a first-class feature: Push steers employees toward strong passwords for work apps and flags credential risk across the SaaS estate. It also does the discovery work security teams usually need separate tools for: SaaS and shadow-IT discovery, AI-tool visibility, browser extension management (detecting and blocking malicious extensions, added in the March 2026 release), DLP building blocks, investigation tooling, and autonomous threat-hunting agents that keep working between incidents.

Every licence includes the full platform — behavioural phishing detection, credential security, session hijacking detection, extension management, AI visibility, SaaS discovery, DLP building blocks, investigation tools and custom detection rules — at every deployment size. That single-SKU approach is refreshing in a market that loves add-on modules.

Deployment is a browser extension rather than an enterprise browser: it force-installs via Intune, Jamf or Google Admin Console, distributes by email enrollment, or self-enrolls from a landing page, and Push claims most customers deploy in under a day with zero downtime. Browser support is broad — Chrome, Edge, Firefox, Safari, Brave, Opera and Arc, plus enterprise browsers (Island, Prisma Access Browser) and agentic browsers (Comet, Atlas, Dia). SIEM integrations cover Microsoft Sentinel, Splunk Cloud, Datadog, Panther and Cribl Cloud, with webhooks for anything else, Slack and Teams alerts, a Tines integration for SOAR, and a REST API. Events carry full context: technique, severity, user, application, timestamp, referrer URL.

Pricing is published and simple: Standard at $5 per user per month billed annually ($6 monthly) for up to 500 employees, Enterprise above 500 with volume discounts by conversation. Payment by card through Stripe or bank transfer; licences can be added or removed at any time and departed employees' licences free up automatically.

My testing notes

The local-first data architecture is the detail I care about most, and I checked it before anything else. Push's stated design is that routine browsing activity never leaves the browser — only activity matching threat detection rules is transmitted. Data is stored in the EU (Dublin, backup Paris), encrypted at rest with AES-256 and in transit with TLS 1.2+, and the trust center holds SOC 2 Type II, ISO 27001, ISO 27701, GDPR and Cyber Essentials attestations. For a product that could, by design, become an employee-surveillance machine, that constraint is a deliberate and load-bearing choice. It also materially changes the privacy conversation with works councils and employee representatives.

Second, the detection set reflects real offensive tradecraft. Cloned login page detection and BitB/BitM detection are responses to techniques that defeat conventional phishing training and email filters, and ClickFix/clipboard-injection blocking targets the social-engineering pattern that has spread fastest in the last two years. In my testing the configurable response modes made rollout realistic: run in monitor mode first, review what the extension surfaces about your environment, then tighten to warn or block per detection class. That staging is how you avoid the classic security-rollout backlash.

Third, the SaaS and extension discovery pays for itself independently of the threat detection. Within days of deployment most teams see a map of SaaS usage, credential hygiene and browser extensions they had no inventory for — the shadow-IT problem security teams know exists and cannot quantify. The March 2026 addition of malicious extension detection and blocking closes a gap that the Chrome Web Store's review process demonstrably leaves open.

What it does not do

Push is not an enterprise browser and does not try to be: there is no managed browser with built-in VDI-style controls, no full data-loss-prevention suite (the DLP features are explicitly "building blocks"), and no email security. If your requirement is a controlled browsing environment with granular app access control, an enterprise browser like Island is a different product category — Push's own comparison argues the extension model is usually the right starting point, and I broadly agree, but the use cases are distinct.

Coverage requires the extension on the devices where work happens; unmanaged personal devices remain invisible unless users enroll. For organisations that cannot install anything on employee browsers, this is a non-starter. The 500-employee line between Standard and Enterprise means larger deployments are quote-based again, though the per-user price below that is refreshingly public. And because detection happens in the browser, attacks that never touch a browser — a compromised API token used from a script, for instance — are outside its view; Push is a strong layer in a defence-in-depth stack, not the whole stack.

One more note on the alerting workflow, since detection without routing is shelfware: Push ships native alerts into Slack and Microsoft Teams for security teams and feeds SIEM platforms with full event context, and the Tines integration covers SOAR-style automated response. In practice this means a session-hijacking detection can land in the channel your team already watches, with the technique, severity, user and referrer attached, and a webhook can push it anywhere else. The response-mode controls (monitor, warn, block) can also be set per detection class, which lets a cautious team block credential attacks on day one while still monitoring the noisy categories.

Verdict

I rate Push Security 4.0: core functionality is genuinely deep for a single extension — the identity-attack detection set matches current attacker tradecraft, and the discovery and credential layers answer questions teams otherwise buy two more tools to solve; value is one of the clearest in security software at $5 per user per month with the full feature set included at every size; usability favours the rollout path (deploy in monitor mode, then tighten), and the under-a-day deployment claim matches what I know of extension distribution; the ecosystem is broad across browsers and solid into SIEM/SOAR tooling; and reliability signals include the EU data model, a strong certification set, SOC 2 Type II, and a technical customer roster. For security teams that want visibility and control where identities actually get used, this is one of the more honest products in the category — small surface, sharp focus, published price. Just make sure you have answers for the devices and attack paths the browser cannot see.

Sources

• https://pushsecurity.com/pricing
• https://pushsecurity.com/
• https://pushsecurity.com/product
• https://pushsecurity.com/about/
• https://pushsecurity.com/news/push-security-secures-30-million-series-b-funding
• https://pushsecurity.com/blog/product-release-march-2026
• https://pushsecurity.com/blog/enterprise-browser-vs-browser-extension-which-should-your-security-team-choose
• https://www.chromeextensions.org/push-security/
• https://work-management.org/network-security/push-security-review
• https://agenticindex.io/vendors/push-security
• https://mspcompanies.us/tools/push-security