Browser isolation vs secure web gateway: what actually stops web threats?

Last updated: 2026-08-20Vendor context: Menlo Security

Browser isolation and secure web gateways (SWGs) both protect users from web-borne threats, but they work in fundamentally different ways. An SWG sits in the traffic path, inspects web requests and blocks what it recognizes as malicious — a detection-based model that is only as good as its ability to recognize the threat. Browser isolation removes the recognition problem entirely: every web session is executed in a remote, air-gapped container, and only a safe rendering reaches the user, so malicious code never runs on the endpoint whether or not anything identified it as malicious.

That architectural difference is why the two approaches behave so differently against zero-hour phishing and highly evasive threats — and why many organizations end up running isolation alongside, not instead of, their existing gateway.

// Side by side

Browser isolation vs Secure web gateway (SWG).

Criterion	Browser isolation	Secure web gateway (SWG)
Zero-day and evasive threat protection	✓ Yes By architecture: unrecognized threats still execute remotely, never on the endpoint.	◐ Partial Detection-dependent: what signatures, reputation and sandboxing miss gets through.
Zero-hour phishing pages	✓ Yes Pages render in isolation; credential-entry policy can be enforced on unknown sites.	◐ Partial Blocklists lag newly registered phishing domains by hours to days.
Requires threat recognition to protect	— No Protection does not depend on classifying the threat first.	✓ Yes Inspection model must identify traffic as malicious to block it.
Malicious file downloads	✓ Yes With CDR (as in Menlo via Votiro), files are rebuilt clean rather than scanned-and-hoped.	◐ Partial AV/sandbox scanning of downloads; evasive payloads are a known gap.
URL filtering & acceptable-use policy	◐ Partial Isolation platforms include policy controls, but this is the SWG heartland.	✓ Yes Mature category strength: categorization, quotas, compliance reporting.
AI-agent browser sessions	✓ Yes Menlo extends isolation and governance to autonomous, machine-driven sessions.	— No Traffic inspection has no session-level governance model for agentic browsing.
User experience impact	◐ Partial Modern isolation is near-native for typical browsing; pixel-heavy apps can differ.	◐ Partial TLS interception adds latency and occasionally breaks applications.
Coexists with the current stack	✓ Yes Commonly deployed alongside an existing SWG/SSE — no rip-and-replace.	✓ Yes Usually already present as part of an SSE/SASE bundle.

Methodology & disclosure: this page compares product approaches, not named competitor products. Approach characteristics reflect how each category of technology works by design, based on public vendor documentation and standard industry architecture. Menlo Security capabilities are taken from the vendor's public materials (linked on our Menlo Security page). Cyberdis is a value-added distributor of Menlo Security — that affiliation is disclosed here deliberately, and we have aimed to represent both approaches fairly, including where the incumbent approach is the better fit.

How browser isolation works

With remote browser isolation, the browser session runs in a disposable cloud container. The user sees and interacts with a safe rendering of the page; the page’s actual code — including any exploit kit, drive-by download or malicious script — executes far away from the device and is destroyed with the container. Because nothing from the live web executes locally, the model does not need to decide whether a page is dangerous, which is precisely the decision attackers have become expert at defeating.

Menlo Security adds Content Disarm and Reconstruction (Votiro CDR) for downloads: instead of scanning a file and passing judgment, the file is rebuilt without active threats while keeping it fully usable.

How a secure web gateway works

An SWG (increasingly bundled into SSE/SASE platforms) proxies web traffic and applies URL categorization, reputation scoring, TLS inspection, anti-malware scanning and data-loss policies. It is a mature, necessary control for acceptable-use policy, compliance visibility and blocking known-bad destinations at scale.

Its structural limitation is the detection dependency: highly evasive threats — attacks built to look benign to inspection engines, delivered through legitimate-looking sites and brand-new domains — are specifically designed to pass this model.

Choose browser isolation when…

Zero-hour phishing and evasive web threats are your top concern — especially for executives, finance and admins.
Endpoints must never execute untrusted web content (regulated, high-value or air-sensitive environments).
AI agents browse on your behalf and need the same governance as human sessions.
You want protection that does not degrade when detection inevitably misses.

An SWG remains the right tool when…

Your primary need is acceptable-use policy, URL filtering and compliance reporting.
It is already included in your SSE/SASE bundle and budget is the constraint.
You need broad, basic web hygiene across a large general-purpose workforce.

// In the Cyberdis portfolio

Where Menlo Security fits

Menlo Security is the browser-security vendor in the Cyberdis portfolio: cloud browser isolation with Votiro CDR built in, zero-hour phishing protection, and governance for AI-agent sessions. The company states that eight of the ten largest banks in the world use Menlo. Cyberdis runs engineer-led proofs of concept against your real traffic patterns — including the evasive-threat scenarios inspection-based tools miss — and takes wins to production with channel partners.

Explore Menlo Security

// FAQ

Common questions.

Do I need browser isolation if I already have a secure web gateway?

They solve different failure modes. The SWG handles policy and known threats; isolation covers what inspection cannot recognize — zero-hour phishing and evasive attacks. Organizations with high-value targets typically deploy isolation alongside the existing gateway rather than replacing it.

Does browser isolation slow down browsing?

Modern isolation renders pages near-natively for typical business browsing. The practical way to judge it is a proof of concept against your own traffic — which is exactly what a Cyberdis PoC measures.

What are highly evasive (HEAT) threats?

Attacks engineered to bypass inspection-based defenses: phishing kits on newly registered domains, malicious content assembled in the browser at runtime, and payloads that look benign to signature and sandbox engines. Isolation neutralizes them by never executing web content on the endpoint.

// Next step

Prove it in your environment.

A Cyberdis engineer will run the Menlo Security proof of concept against your real scenario — and tell you honestly what they find.

Request a PoC More comparisons