Ask the office which browsers it runs and you will get the policy answer: "Chrome, standardised last year." Run the inventory and you will get the real answer — Chrome, plus Edge, plus two Firefoxes, a Brave, something called Whale, and a browser nobody can identify. Compliance starts at the gap between those two answers.
Every browser security project that fails, fails at the same step: it secures the environment described in the policy document, not the one installed on the desks. Browser Security Plus begins, correctly, with discovery — its agent reports the browsers present on Windows and Mac machines, and the list is wider than most admins expect, because ManageEngine built the product for the real world: Chrome, Edge and Firefox, yes, but also Brave, Vivaldi, Yandex, Naver Whale and Ulaa show up in offices, carried in by one user's preference and left running for years. This guide uses that inventory as it should be used — as the foundation for the compliance score, the removal list, and an honest statement of what sits outside the console's reach.
Each browser is its own patch stream, extension store and settings file. A perfect Chrome policy over an office that also runs an unpatched Firefox is a locked front door beside an open window. The census converts arguments into facts: it settles what the standard actually is, which exceptions exist, and which machines run things nobody approved. It is also the fastest credibility win in the whole project — print the census, pin it next to the policy that claims standardisation, and the office conversation about browser security becomes honest in one meeting.
Sort the census into three lists. Standard: the one or two browsers the office supports, patches and writes policy for — for most offices, Chrome or Edge, chosen once. Exceptions: a named browser on named machines for a named reason (the bank portal that demands Firefox), which joins the update watchlist from the browser-updates guide. Removals: everything else, uninstalled in the announced cleanup. Resist adding a third column called "later" — later is where the 2023 Firefox came from. Browsers like Brave or Whale are not villains; they are simply unsupported here, and "unsupported here" is a complete and fair reason.
With the census clean, the compliance score becomes meaningful. Browser Security Plus measures browser configurations against the CIS and STIG benchmarks and grades each computer — highly vulnerable, vulnerable, low risk, secure. Work the list worst-first: a highly vulnerable grade names its reasons (password saving on, safe browsing off, ancient version), and most fixes deploy from the same console as policies. Re-run the report after each fix round. The score is not a judgement on the user of that PC; it is a measurement of the settings your office allowed, which is why it belongs in the management report and not in a scolding email.
Reception PCs, training-room machines and the warehouse terminal are a special census entry: many hands, no owner. For these, Browser Security Plus offers browser lockdown — the browser opens full-screen, restricted to the approved sites only, with no wandering. It is the one place where the strictest possible setting is also the kindest, because a shared PC that can only open the dispatch system cannot be the PC that imports the office's next infection or leaks the last user's session. List shared machines in their own policy group from day one.
Close honestly. The inventory covers managed office computers. It does not see the browser on a staff member's personal phone, home laptop or the tablet in the canteen — and if staff do office work on those, that is a policy question (is personal-device work allowed, under what protection?) that no console answers for you. Inside its sight, though, the census is complete and repeatable: run it quarterly, because browsers drift back the way extensions did. The office you measured is the office you have — for exactly as long as you keep measuring it.
The census, the CIS grades and the lockdown group — the video shows the dashboard views this guide is built on.
▶️ Watch Full VideoOne install at a time, each with a reason that made sense that day: a site that demanded a specific browser, a new joiner's preference, a laptop image from a different year. No single step is wrong — the problem is that nobody ever recounts. The census exists because the fleet drifts, quietly and always, away from whatever the policy says.
It compares each browser's real configuration against the Center for Internet Security benchmarks (and STIG standards): settings like safe browsing, password saving, update state and dozens of smaller hardening items. The grade — from highly vulnerable to secure — summarises how far that machine's browsers sit from the benchmark, and the report names the specific settings to fix.
Quarterly is a workable rhythm for a small office, and after any big change — a merger of teams, new laptops, a new standard browser. The point is not the calendar; it is that drift is constant, so the count must recur. A census run once is a photograph; run on schedule, it becomes a control.