Zscaler acquires SquareX to extend Zero Trust controls into browsers

2026-02-09 · Source: Tech Monitor · Field: Technology & Digital — Cybersecurity & Data Privacy, Cloud Computing & IT Infrastructure · Depth: Intermediate, short

Summary

Zscaler, a Nasdaq-listed cloud-native cybersecurity company, has acquired San Francisco-based SquareX to enhance its Zero Trust controls within web browsers. The acquisition aims to secure access from unmanaged and third-party devices by integrating SquareX's Browser Detection and Response (BDR) product into Zscaler's Zero Trust Browser platform. SquareX's technology uses lightweight browser extensions across common browsers like Google Chrome and Microsoft Edge to monitor and respond to client-side threats, providing real-time detection and visibility into in-browser events. This move addresses the security gap presented by web applications becoming primary enterprise execution environments and offers an alternative to legacy VPNs and VDIs for securing SaaS and private applications, including support for work profiles, data loss prevention, and device posture checks on BYOD endpoints. Zscaler previously acquired AI security platform SplxAI and MDR provider Red Canary in the last year.

Key takeaway

For IT professionals and security engineers managing distributed environments with unmanaged or BYOD endpoints, Zscaler's acquisition of SquareX signals a shift towards browser-centric Zero Trust security. You should evaluate how integrated browser threat detection and response, coupled with granular access controls, can replace legacy VPNs/VDIs and enhance data protection without requiring full endpoint agents or third-party browsers.

Key insights

Integrating browser-level security with Zero Trust principles enhances protection for web applications and unmanaged devices.

Principles

• Browsers are critical attack surfaces.
• Zero Trust extends to browser sessions.
• Lightweight extensions can secure endpoints.

Method

SquareX's BDR product integrates as a lightweight browser extension, providing real-time threat detection, response, and visibility into in-browser events, while enabling least-privilege access controls for SaaS and private applications.

In practice

• Secure SaaS apps on BYOD devices.
• Replace VPNs/VDIs for some use cases.
• Implement browser data loss prevention.

Topics

• Zero Trust Security
• Browser Security
• Client-Side Threat Detection
• Cybersecurity Acquisitions
• Endpoint Security

Best for: Executive, Investor, Security Engineer, IT Professional, CTO

Related on AIssential

• Video Quick Take: Implementing Zero Trust in an AI-Driven Threat Landscape - SPONSOR CONTENT FROM THREATLOCKER — Zero Trust prevents AI-driven threats by disallowing unknown behaviors, automating discovery to ease implementation.
• Dragos acquires Phosphorus to expand xOT device security — Dragos's acquisition of Phosphorus extends OT security to "xOT," securing critical infrastructure's invisible connected devices.
• CloudFront Adds Origin mTLS Authentication for End-to-End Zero Trust — CloudFront's origin mTLS enables cryptographic, end-to-end zero-trust authentication, replacing IP allowlists and shared secrets.
• The disappearing office IP — Distributed work invalidates the office IP as a security boundary, necessitating managed egress points for consistent network identity.
• AI text-to-speech gives Manx a digital voice as speakers fall to 2,200 — Security verification prevents automated abuse by validating browser connections.
• How a malicious link could bypass your PC’s built-in SmartScreen — Zero-day vulnerabilities in Windows and Office are under active exploitation, bypassing built-in security features like SmartScreen.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Tech Monitor.