What Is Menlo Security? Browser Isolation and AI Agents, Explained for 2026

Menlo Security is the company most people think of when they hear "browser isolation." It built its name on a simple idea: never let web content run on the laptop. In 2026 Menlo turned that idea into a full Browser Security Platform, added AI-based DLP, and started pitching security for AI agents as hard as security for people. If you are already comparing vendors, our head-to-head on Menlo Security vs Zscaler is the quickest way in. This guide answers the earlier question: what Menlo Security actually is heading into 2027, how it works, and where its model stops.

The short answer

Menlo Security is a privately held cloud security company based in Mountain View, California. Its platform loads web pages in a remote browser in the Menlo Cloud, runs the active content there, and sends a safe version down to the device. Around that core, Menlo now sells a secure enterprise browser, browser DLP, AI Adaptive DLP, file security, remote access, and Menlo Agent Runtime Security (MARS) for AI agents.

The control point is the browser session and the Menlo Cloud. That is a strong place to stop browser-borne threats. It also means Menlo protects what is routed through it. dope.security takes the opposite approach: an SSL inspection proxy runs on the device itself, sees web traffic from every app on the laptop, and sends it direct to the destination.

That is a testable claim. Open ChatGPT in a tab, then ChatGPT Desktop, then an AI coding assistant in your terminal, and check which of them your browser security platform actually logged.

What is Menlo Security?

Menlo Security grew up as the remote browser isolation specialist and has steadily widened its product family. Today its lineup includes:

• Remote browser isolation. The original product. Web content runs in a Menlo Cloud container, not on the laptop.
• Secure Enterprise Browser. Turns a standard browser into a managed, policy-enforced one.
• Browser DLP and AI Adaptive DLP. Data controls on what users upload, paste, and download.
• File security. Content disarm and reconstruction, strengthened by Menlo’s February 2025 acquisition of Votiro.
• Remote access. Browser-based access to private and SaaS applications.
• AI Agent Security (MARS). Runtime guardrails for AI assistants, coding agents, and autonomous agents.

What changed at Menlo in 2026

• February 2026: Bill Robbins, Menlo’s president since 2024, became CEO. Co-founder Amir Ben-Efraim moved to executive chairman. Menlo said it passed $140 million in annual recurring revenue in the fiscal year ending that January.
• March 2026: Menlo launched its Browser Security Platform, built on the argument that the browser is now where both people and AI agents work.
• April 2026: Menlo AI Adaptive DLP became generally available.
• August 2026: Menlo extended MARS to protect browser assistants like Microsoft Copilot and Gemini in Chrome, coding agents like Claude Code, and desktop assistants like Claude Cowork.

How Menlo Security works

When a user browses to a site, the request goes to the Menlo Cloud. A remote browser there fetches the page and runs its scripts. Menlo then sends a safe representation of the page to the user’s local browser. Menlo’s rendering approach, which it calls Adaptive Clientless Rendering, mirrors the page structure instead of streaming pixels, which keeps pages lighter and more usable than video-style isolation.

Files get similar treatment. Downloads and uploads can be sanitized in the cloud to strip malware and hidden content before they reach the person, or now the agent, on the other end.

How MARS works for AI agents

MARS applies the same model to AI agents. According to Menlo, coding agents and autonomous agents reach the web and files through MARS, which runs that activity in the Menlo Cloud and cleans pages and files before the agent sees them. That strips prompt injection hidden in white-on-white text or file metadata. MARS also adds per-agent policy, token-based agent authentication, activity logs, and session recording.

That is a real step forward from a browser-tab-only story, and credit is due. The operational question for 2027 is coverage: which agents, CLIs, and desktop apps in your fleet are actually configured to go through MARS, and which ones talk to the internet directly.

Does Menlo Security slow browsing down?

Any cloud-delivered inspection adds a detour: device to the vendor’s point of presence, out to the destination, and back. Isolation adds rendering work on top. Measured cloud-proxy latency typically runs 40 to 80 milliseconds near a point of presence and 150 to 400 milliseconds when users are far from one, and a modern SaaS page chains dozens of requests. The math is in the latency math behind cloud proxy SWGs.

Rendering compatibility is the other half. Any time one browser renders a page and another displays it, interactive apps, challenge pages, and complex SaaS workflows need testing. Track how many exceptions you add in week one of a pilot. Each exception is traffic outside the isolation layer.

How much is the detour costing you? Run the Fly-Direct Speed Test to measure your real round-trip latency and compare a cloud-proxy or isolation detour with inspection on the device. Or book a 20-minute demo to see it live.

What Menlo Security does well

• Zero-day web threats. If active content never runs on the device, a browser exploit has nothing to land on. For high-risk browsing, that is a strong control.
• Unmanaged and contractor devices. Menlo is delivered from the cloud with no endpoint agent required, so it reaches BYOD, contractor, and M&A devices you cannot install software on.
• Masking instead of blocking. AI Adaptive DLP masks sensitive values in a file and delivers the rest, which keeps work moving. Menlo reports 92% detection accuracy in its own testing.
• An early, serious bet on agents. MARS treats AI agents as a security population with their own policy and forensics, which many incumbents still do not.

Where Menlo Security’s model stops

It protects what is routed through it

Menlo’s control point is the browser session and the Menlo Cloud. Browser tabs are covered by design, and MARS covers the agents you point at it. Native apps and tools that go straight to the internet are a different story: ChatGPT Desktop, IDE extensions, command-line tools, scripts calling AI APIs, and MCP servers in developer environments. We map that surface in how to detect shadow AI in desktop apps, IDEs, and CLIs and MCP server security and governance.

DLP decisions happen in the cloud

AI Adaptive DLP is a real upgrade over dictionary matching. It still works on content that passes through the Menlo Cloud, across browsers, email, Teams, Slack, OneDrive, SharePoint, Box, and Amazon S3. If a prompt or upload never touches that path, the policy never sees it. Ask how a paste into a desktop AI app is handled before you assume coverage.

Every isolated page takes a trip

Isolation moves the risk off the laptop by moving browsing into the cloud. Every page pays for that trip, and remote users far from a point of presence pay the most.

Menlo Security vs dope.security: the head-to-head

Both products want web traffic to be safe without slowing people down. They put the control point in different places.

• Where the control point lives. Menlo runs browsing and agent web activity in its cloud and sends sanitized content to the device. dope.security inspects traffic on the device with an on-device SSL inspection proxy and sends it direct.
• Network path. Menlo routes isolated and proxied traffic through the Menlo Cloud. dope.security has no stopover in the data path and delivers up to 4x performance over legacy proxy SWGs.
• AI surfaces covered. Menlo covers browser sessions plus agents routed through MARS. dope.security inspects web egress from the endpoint, so AI traffic from desktop apps and tools is in scope. For Claude, Cloud Application Control covers both the web app and the desktop app.
• Personal vs corporate AI accounts. dope.security Cloud Application Control allows the enterprise tenant and blocks personal ChatGPT, Claude, Google, and Microsoft 365 logins on the same domain.
• DLP approach. Menlo masks sensitive data in the cloud. Dopamine DLP extracts text from prompts and uploads on the device and classifies them by meaning with an LLM with zero data retention. No regex rules to write. Block, Monitor, or Off.
• AI visibility. dope.security AI Analytics shows which AI apps people use, personal versus enterprise accounts, and lets you block from the same screen. The Dopamine agent answers plain-language questions like "is anyone using DeepSeek?"
• Device coverage. Menlo reaches unmanaged devices without an agent. dope.security runs on managed Mac and Windows devices, with an agent under 100 MB of RAM and one console for SWG, CASB Neural, and Dopamine DLP.

For a wider field, our Menlo Security alternatives guide ranks the options, and do you need a secure enterprise browser covers the browser-first category as a whole.

Questions to ask in a Menlo Security proof of concept

• Which AI tools does the policy actually see? Test ChatGPT in a tab, ChatGPT Desktop, and an AI assistant in an IDE or terminal. Note which show up in the logs.
• Which agents are routed through MARS today? List every coding agent and CLI in use, then confirm which ones are configured to use it.
• How many isolation exceptions do we need in week one? Every exception is traffic outside the isolation layer.
• What does a pasted paragraph of source code trigger? Test unstructured content, not just card numbers.
• Can we allow corporate ChatGPT and block personal ChatGPT? Run the same-domain tenant test live and confirm it is enforced, not just reported.
• What do remote users feel? Measure heavy SaaS page loads from home networks and from abroad.

Do you still need browser isolation in 2027?

For a slice of traffic, yes. Isolation earns its keep for high-risk categories, uncategorized sites, and unmanaged devices. For the managed laptops that make up most of a 250 to 5,000 person workforce, the bigger risks are data leaving through AI prompts and uploads, personal SaaS accounts, and AI tools that never open a browser tab. Those are endpoint problems, and they are cheaper to solve where the data starts.

A practical pattern: keep isolation narrow and move general web security, AI tenant control, and DLP onto the device. Rollout is rarely the obstacle. Greylock Partners replaced Cisco Umbrella with dope.security and went from first proposal to signed contract in 27 days, deploying through Intune. Read how Greylock Partners made the switch.

The bottom line on Menlo Security

Menlo Security secures the browser session very well, and MARS shows it is taking AI agents seriously. Its model protects what passes through the Menlo Cloud. If you want web security, AI governance, and DLP that cover every app on the laptop and send traffic direct, that is what dope.security was built to do. Explore the Fly-Direct Secure Web Gateway, see how teams block personal ChatGPT while keeping the corporate account, or book a 20-minute demo.

Frequently asked questions

What does Menlo Security do?

Menlo Security provides cloud-delivered browser security centered on remote browser isolation. Web pages load and run in a remote browser in the Menlo Cloud, and a safe version is sent to the device. Menlo also sells a secure enterprise browser, browser DLP, AI Adaptive DLP, file security, remote access, and MARS for AI agents.

Who is the CEO of Menlo Security?

Bill Robbins became CEO of Menlo Security in February 2026. He joined as president in 2024. Co-founder Amir Ben-Efraim, the previous CEO, became executive chairman.

What is Menlo MARS?

MARS stands for Menlo Agent Runtime Security. It protects AI assistants, coding agents, and autonomous agents by running their web activity in the Menlo Cloud and sanitizing pages and files before the agent reads them, which strips hidden prompt injection. It adds per-agent policy, authentication, logs, and session recording.

Is Menlo Security a secure web gateway?

Menlo offers secure web gateway capabilities, but its identity is browser isolation and browser security. Traffic is proxied and, for isolated sessions, rendered in the Menlo Cloud. dope.security is a Fly-Direct secure web gateway that performs SSL inspection on the device, so there is no cloud detour in the data path.

What is the best Menlo Security alternative?

For teams whose priority is AI governance and DLP across every app on managed laptops, not just the browser, dope.security is a strong alternative. It combines an on-device SSL inspection proxy, Cloud Application Control for corporate-only AI tenants, AI Analytics, and Dopamine DLP for prompts and uploads under one console. If you mainly need to protect unmanaged devices, browser-delivered tools like Menlo remain a good fit.