Your staff do almost everything inside a browser now — email, banking, office apps, even the phone system. That makes the browser the real front door of your office, and on most PCs it is the one door nobody has locked. This guide shows how ManageEngine Browser Security Plus locks it, from one console.
Think about one ordinary office PC. Chrome has fourteen extensions nobody remembers installing. Passwords for the bank and the supplier portal are saved in the browser. A two-year-old Firefox sits in a corner, never updated. And the user clicked a "invoice" link last week that was not an invoice at all. None of this is unusual — it is the default state of an unmanaged browser. Browser Security Plus is ManageEngine's tool for fixing exactly this: it puts an agent on each office computer, discovers the browsers installed there, and lets the admin push security policies to all of them from one console — Chrome, Microsoft Edge, Firefox and several others, on Windows and Mac. This page walks the full setup in the right order: first see what you have, then control extensions, then block threats, then stop data leaks, and finally measure the result with the built-in compliance score. The video above shows the same console live, screen by screen.
You cannot secure what you have not counted. Once the agent is deployed, Browser Security Plus reports every browser on every computer — including the ones nobody in IT installed. Do not skip this step: the inventory almost always contains a surprise, such as an old Firefox, a portable browser in a Downloads folder, or three browsers where the office standard says one.
That list decides everything else. A policy for Chrome means nothing to the PC that does its banking in an unpatched browser from 2022.
ManageEngine organises browser security as policies that you build once and deploy to groups of computers. The policy areas follow the real risks:
Start with a pilot group, watch what breaks for a week, then widen the deployment. Rolling a strict policy out to the whole office on day one is how admins earn a very busy Monday.
Extensions are small programs that run inside the browser with wide permissions — many can read the content of every page the user opens. Browser Security Plus lets you silently distribute the approved ones (your password manager, your PDF tool), block the rest, and see the permission list of anything already installed.
The dedicated guide in this series — Browser Extensions in the Office — covers the audit in depth, because this one policy removes more silent risk than everything else combined.
This is the shield against the link in the fake invoice email. Threat protection keeps the browser's own defences — safe browsing in Chrome, SmartScreen in Edge — switched on and locked, so a user cannot turn them off. Web filtering blocks categories of sites your office has no business visiting, and web isolation can open an untrusted site inside a sandboxed window, so a drive-by download never lands on the real PC.
The same browser that opens your office apps can quietly upload your files to a personal cloud drive. The data leakage policies cover the everyday leaks: password saving in the browser, autofill of card and address data, and which sites may receive uploads. You do not need the strictest setting on day one — you need the setting your office can actually live with, applied to every PC instead of the three PCs whose users remembered to configure it themselves. The case guide in this series on data leaks goes through the upload and paste routes one by one, with honest limits.
Browser Security Plus benchmarks each computer's browser settings against the CIS (Center for Internet Security) and STIG standards and grades the machine — highly vulnerable, vulnerable, low risk or secure. This turns "browser security" from a feeling into a list:
That before-and-after number is also the easiest report you will ever show your boss: it proves the work did something.
End with the limits, because believing them is part of using the tool well. Browser Security Plus manages browsers on computers that have its agent — office desktops and laptops you own. It does not reach a staff member's personal phone or home PC, it does not watch a browser a user runs from a USB stick outside the managed list the same way, and it does not replace your antivirus or your firewall. A blocked user with a personal laptop and a phone hotspot still has a door — it is just no longer the office's door, and no longer the office's data, if your other policies are doing their job. Use the console to close the doors you own, and use a written office policy for the rest.
Every policy in this guide, created live in the console — plus the order Anshu recommends for a small office rollout.
▶️ Watch Full VideoIt manages the popular desktop browsers from one console — Google Chrome, Microsoft Edge and Mozilla Firefox are the core three, and ManageEngine also lists browsers such as Brave, Vivaldi, Yandex, Naver Whale and Ulaa. It works on Windows and Mac computers that have the product's agent installed. It does not manage browsers on personal phones.
Both. ManageEngine sells it as a standalone product, and it is also available as an add-on for Endpoint Central, so offices already using Endpoint Central for patching can manage browser security from the same family of tools. The exact edition decides which features, like web isolation, are included — check the current edition comparison before you buy.
Mostly, no — and that is by design. Approved extensions install silently, the homepage and bookmarks standardise, and safe browsing simply stays on. Staff notice only when something they used to do is blocked: an unapproved extension disappears, or a website category is filtered. Tell people before the rollout anyway; a five-line notice saves fifty support calls.