In short: Sophos Protected Browser is a secure enterprise browser built on Chromium, also available as a lightweight extension for Chrome and Edge. It applies per-app policies over copy and paste, uploads, downloads, printing and screen capture, includes Sophos ZTNA and RDP/SSH clients, and is licensed through Sophos Workspace Protection.
What is Sophos Protected Browser?
An enterprise browser is a browser that the organisation, rather than the user, sets the rules for. Sophos Protected Browser is Sophos's version: a hardened browser based on Chromium, so it looks and behaves like the browsers people already use, with security policies enforced inside the browsing session itself.
That matters because the browser is now where sensitive data lives. Customer records in a CRM, files in Microsoft 365, payroll in a SaaS platform and prompts typed into AI tools all pass through it. Protected Browser lets you treat those applications differently from general web browsing, and it is managed in Sophos Fusion with the rest of your Sophos estate.
Sophos sells it as part of the Sophos Workspace Protection bundle, alongside Sophos ZTNA, DNS Protection for endpoints and the Email Monitoring System.
Full browser or browser extension
| Option | What it is | When to choose it |
|---|---|---|
| Protected Browser | A separate, hardened Chromium-based browser installed on the device | Strongest protection for critical web apps; contractor and third-party access; high-risk roles |
| Protected Browser extension | An extension that applies policies inside existing Chromium-based browsers such as Chrome or Edge | Lighter touch for staff on managed devices; gradual rollouts where you do not want to change browser |
One practical difference: Sophos's documentation notes that DNS Protection settings in the browser are available only in the full Protected Browser, not the extension. A common pattern is the extension for most staff on managed devices, and the full browser for sensitive applications or for people working from devices you do not manage.
Data protection controls
Policies are set per application or website, so you can be strict where it counts and relaxed elsewhere. Controls Sophos lists include:
- Copy and paste limits from selected apps, so data from an internal system cannot be pasted into a personal webmail or AI chat
- Upload and download control, for example allowing viewing of documents in a SaaS app but blocking downloads to an unmanaged device
- Print restrictions for selected app data
- Screenshot and screen capture blocking in protected apps
- Data redaction of sensitive content
- Generative AI controls: see which generative AI services are in use, block unsanctioned ones, and restrict copy and paste, uploads and downloads in the ones you allow
These controls are enforced inside the browser session, so they work wherever the user is. For AI-specific discovery and policy across endpoints, firewall and browser, see Sophos AI Defense.
Making sure SaaS apps are only used through Protected Browser
Controls in a browser only help if people cannot simply open the same app in another browser. Sophos documents browser enforcement for this, with set-up guides for Microsoft Entra ID and for Okta. In the Entra ID set-up, Protected Browser traffic reaches your SaaS sign-in through a Sophos ZTNA data plane region; you add that region's IP addresses as a named location and create a Conditional Access policy that blocks sign-ins from any other address. The result is that the app can only be reached from Protected Browser.
Private app access with built-in Sophos ZTNA
Sophos ZTNA is built into Protected Browser. Private web applications can be published through a ZTNA gateway and reached from the browser while staying hidden from the internet. The browser also includes RDP and SSH clients, so administrators and suppliers can reach servers without a separate VPN client or exposed remote desktop ports.
Before granting access, Protected Browser can check the device's posture: its operating system, whether endpoint protection is running (Sophos or another vendor's) and whether the disk is encrypted. With Synchronized Security, a device that Sophos Endpoint reports as compromised can be blocked from important apps until it is clean.
Use cases: contractors, BYOD and hybrid work
- Contractors and suppliers: give access to one SaaS tool or an internal web app, with downloads and copying blocked, without enrolling their device
- Bring your own device: let staff use personal laptops for email and core apps while keeping company data inside the controlled browser
- Mergers and acquisitions: give staff from an acquired business access to selected systems on day one
- Privileged access: route RDP and SSH sessions to servers through ZTNA rather than open ports
- Hybrid staff: apply the same web and data policies at home, in the office and on public Wi-Fi
Platforms and identity providers
- Protected Browser: Windows 10 and 11, Windows Server 2022 and 2025 (Intel processors, with ARM listed by Sophos as coming soon), and macOS Sonoma, Sequoia and Tahoe on Intel and Apple silicon
- Extension: Chromium-based browsers, such as Google Chrome and Microsoft Edge, on Windows and Mac
- Identity providers: Microsoft Entra ID and Okta
- Device posture checks: operating system, endpoint protection (Sophos or other vendors) and disk encryption status
- Licensing: through Sophos Workspace Protection, counted as unique authenticated users over 30 days
We always check the current Sophos support list against your devices before rollout, because platform support is updated frequently.
How we help
We help you decide where the full browser is worth it and where the extension is enough, connect Protected Browser to Microsoft Entra ID or Okta, write per-app policies that match how teams work, and pilot with a small group before wider rollout. If you need private app access too, we set up Sophos ZTNA at the same time.
Contact us to discuss a pilot or a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is a secure enterprise browser?
A secure enterprise browser is a browser whose security and data policies are set centrally by the organisation. It can control copying, downloading, printing and screen capture in business apps, and check device health before allowing access.
Is Sophos Protected Browser based on Chrome?
Sophos Protected Browser is built on Chromium, the open-source project that Google Chrome and Microsoft Edge are also based on, so it feels familiar to users. There is also an extension for existing Chromium-based browsers.
Can Sophos Protected Browser be used on personal devices?
Yes, that is one of its main uses. Contractors and staff on personal devices can reach approved apps through the browser while copying, downloading and printing are restricted, and the browser can check device posture first.
How is Sophos Protected Browser licensed?
Sophos sells Protected Browser as part of the Sophos Workspace Protection bundle. Protected Browser usage is counted as unique authenticated users over 30 days. Ask us for a quote.
Can I stop staff opening our SaaS apps in another browser?
Yes. Sophos documents browser enforcement for Microsoft Entra ID and Okta. With Entra ID, for example, a Conditional Access policy allows sign-ins only from the Sophos ZTNA data plane addresses that Protected Browser uses, so the app cannot be opened in another browser.