Push Security

• CrowdStrike and Jamf bought browser-security startups in 2026, and an endpoint or device-management vendor that bundles browser detection could win Push’s buyers without a separate purchase.
• Proofpoint Advanced Browser Protection, built with Push, is expected to be available in early 2027, so no customer adoption of it appears in the reviewed sources yet.
• Push’s scale figures are its own, 1.5 million endpoints at the Series B and over 3 million browsers in a May 2026 blog post, and no independent source in the review confirms them.
• Push’s detection claims are its own, and no independent test of its detection accuracy appears in the reviewed sources.

Push sells to corporate security teams that need to see and stop attacks inside the browser session, where employees sign in to SaaS apps, paste content and use AI tools. Push describes its product as a browser-native security platform built for security teams. On its homepage it calls the browser the layer where external attacks and employees’ AI misuse are both visible and stoppable.

Independent reporting describes the attack classes Push targets. Ars Technica reported in November 2025 that security firms say ClickFix campaigns have run rampant. BleepingComputer described ConsentFix in December 2025, a technique Push found that steals OAuth authorization codes to obtain an Azure CLI access token. Azure CLI is Microsoft’s command-line application for managing Azure and Microsoft 365 resources.

Most respondents to Futurum’s survey have yet to deploy browser security widely. Futurum survey data published in January 2026 put widespread browser-security deployment at 19.7% of respondents, which places the category in early adoption. [s1, s17, s28, s25, s29]

The Push Security Platform is a single browser extension that collects browser telemetry, applies real-time controls and runs autonomous detection agents. Push says it works in the browsers employees already use, including AI and enterprise browsers. Push says it detects phishing and session hijacking from behavioral signals and blocks them before an account is compromised.

The same extension covers AI use, identity and data. Push says it identifies every AI app employees access, what data they share and what permissions they grant, and it captures file uploads, clipboard activity and OAuth grants to third-party apps. Push lists configurable monitor, warn and block response modes among its features.

Push builds detections with AI agents. Push says on its product page that the browser agent captures trillions of browser events for its agents to hunt and that agents trained on its internal knowledge base and detection libraries develop new detections. In a May 2026 blog post, Push said the pipeline had tripled the cumulative number of detections shipped to customers that year. [s1, s2, s4, s13, s15]

Push competes with enterprise browsers and with other browser extensions. It publishes a comparison page against Island, which it describes as an enterprise browser built for IT teams, and a LayerX comparison page on which it calls both products browser security extensions. In a 2026 ranking of browser security solutions, Push placed itself, Island and LayerX at the top, and in a ranking of shadow IT tools it listed Grip Security.

Larger platform vendors are buying Push’s rivals. In that ranking, Push states that CrowdStrike bought Seraphic, Zscaler absorbed SquareX, Akamai completed its acquisition of LayerX and Jamf acquired Keep Aware, all in 2026. BankInfoSecurity separately reports that Jamf bought Keep Aware to fill a gap in visibility and control over browser activity, and Futurum analyzed CrowdStrike’s definitive agreement to acquire Seraphic. Those products now belong to larger vendors that can sell them alongside their existing products.

Push works with Proofpoint as a partner. Push announced in September 2026 that its detection powers Proofpoint Advanced Browser Protection, and Proofpoint says it built the product in partnership with Push. Push expects the product to be available in early 2027. [s16, s17, s18, s19, s31, s29, s9, s10]

Push publishes named customers. Push’s customer stories cover Convex Insurance, an international specialty insurer, Victoria University of Wellington, where Push deployed to about 3,000 managed devices, and Cribl. Push lists GitLab, Sophos, Ramp, GreyNoise, Thinkst and Upvest among organizations that trust it on its homepage and trust portal, and it quotes GitLab’s CISO Josh Lemos.

Push’s scale figures are its own. SiliconANGLE relayed the company’s statement that its customer base grew 380% year over year as of January 2025, off an undisclosed base, with deployment on more than 1.5 million endpoints. In a May 2026 blog post, Push said it was deployed in over 3 million browsers.

Push sells through partners. Its standard plan covers organizations of up to 500 employees at $5 per employee per month on an annual contract or $6 per employee per month when billed monthly, with negotiated enterprise pricing above that. It announced a reseller partnership with GuidePoint Security in October 2025 and the Proofpoint partnership in September 2026. [s6, s7, s8, s5, s1, s21, s22, s15, s4, s11, s9]

Push’s co-founders lead the company, with Adam Bateman as CEO, Tyrone Erasmus as CTO and Jacques Louw as CPO. Push says its leadership team is ex-MWR InfoSecurity and Duo Security, and TechCrunch reported that Duo co-founders Dug Song and Jon Oberheide invested in its Series A. Companies House records Push Security Ltd as an active UK private company incorporated on 12 November 2019, with a registered office in London.

Push’s research team has an independently reported record. BleepingComputer reported in December 2025 that Push discovered ConsentFix, and it later reported that researcher John Hammond built a second version on Push’s original. BleepingComputer also reported Push’s discovery of a campaign involving fraudulent OpenAI organization invitations in June 2026, and Ars Technica cited Push’s ClickFix reporting.

Push hired commercial leadership from larger security vendors. Its chief revenue officer, Kevin Arsenault, joined in November 2024 and was part of CrowdStrike’s early sales team, according to Push’s announcement. [s3, s23, s24, s25, s26, s27, s28, s20]

Push publishes its certifications on a trust portal. It lists a SOC 2 Type II report audited by Linford & Co LLP, ISO/IEC 27001 and ISO/IEC 27701 certifications, and a Cyber Essentials certification under the UK Government backed scheme.

Push describes a local-first data design for a product that runs inside employees’ browsers. Push says on its pricing page that routine browsing activity is never transmitted to Push. It stores platform data in the EU, in Dublin with a backup in Paris, encrypted at rest and in transit. [s5, s4]

Add analyzed competitors to compare them side by side with Push Security.

Push targets corporate security teams, and it separates that buyer from IT operations in its comparison against Island. Push describes Island as an enterprise browser built for IT teams and itself as a browser-native security platform built for security teams.

Push’s customers span sizes and sectors. Its customer stories include Convex Insurance, an international specialty insurer, and Victoria University of Wellington, a public university with about 3,000 staff and faculty, alongside technology companies such as GitLab and Cribl.

Push’s pricing serves both ends of that range. Push offers a standard plan for organizations of up to 500 employees and negotiates enterprise pricing above that. Push says on its pricing page that every license includes the full platform, whether a customer deploys to 100 users or 100,000.

Push uses AI to build detections and sells controls over employees’ AI use. Push says on its product page that agents hunt trillions of captured browser events and that agents trained on its internal knowledge base and detection libraries develop new detections. Push says the agents combine threat intelligence, human-led research and AI-derived analysis to choose new hunts.

Push reports concrete output from that pipeline. In a May 2026 blog post, Push said the pipeline found 12 meaningful results from trillions of browser events across its install base and had tripled the cumulative detections shipped to customers that year.

For AI governance, Push says it identifies every AI app employees access, what data they share and what permissions they grant. Push lets a security team monitor, warn on or block that activity.

Push sells through its own sales teamand a reseller, GuidePoint Security, whose partnership it announced in October 2025. In September 2026 Push announced that its detection powers Proofpoint Advanced Browser Protection, which Proofpoint says it built in partnership with Push and which Push expects to be available in early 2027.

Push names its customers publicly. Push’s customer stories cover Convex Insurance, Victoria University of Wellington and Cribl, and Push lists GitLab, Cribl, GreyNoise, Riskledger, Upvest, Thinkst and PortSwigger on its trust portal.

The growth figures Push has published are its own. SiliconANGLE relayed Push’s statement that its customer base grew 380% year over year as of January 2025, off an undisclosed base.

Push funds that motion with venture capital. SecurityWeek reported that a $30 million Series B brought Push’s total funding to $49 million, and SiliconANGLE reported that Redpoint Ventures led the round.

Push prices per employee. Push lists $5 per employee per month on an annual contract and $6 per employee per month billed monthly for organizations of up to 500 employees, both billed in advance.

Above 500 employees Push negotiates enterprise pricing with volume discounts. Every license includes the full platform, including phishing detection, session hijacking detection, extension management, AI visibility, SaaS discovery, DLP building blocks and custom detection rules.

Publishing a price lets a smaller security team evaluate Push without a sales call, while larger organizations have to contact Push for pricing.

Push delivers software that the customer’s security team operates. Customers can deploy the extension through device management, email enrollment or self-enrollment, and Push says most customers deploy in under a day with zero downtime.

Push ships detection content to customers as part of the product. In a May 2026 blog post, Push said its researchers shipped a new detection to every customer after its pipeline found an attack.

A customer can connect Push to its own tools. Push lists native SIEM integrations for Microsoft Sentinel, Splunk Cloud, Datadog, Panther and Cribl Cloud, plus webhooks.

Push lists its certifications on a public trust portal. They include a SOC 2 Type II report audited by Linford & Co LLP, ISO/IEC 27001 and ISO/IEC 27701 certifications, and a Cyber Essentials certification.

Push answers the obvious objection to a browser extension with a local-first design. It says routine browsing activity is never transmitted to Push and that platform data is stored in the EU, in Dublin with a backup in Paris.

Push works as an extension inside browsers a customer already runs. It says it supports all popular browsers, including AI and enterprise browsers, so a customer can add Push without moving employees to a new browser.

Push connects to the customer’s security stack. It lists native SIEM integrations for Microsoft Sentinel, Splunk Cloud, Datadog, Panther and Cribl Cloud, standard webhooks for other platforms, and identity-provider integrations.

Push has partnerships with GuidePoint Security and Proofpoint. GuidePoint Security resells Push, and Proofpoint says it built Advanced Browser Protection in partnership with Push, a product Push expects to be available in early 2027.

Larger vendors are also buying browser-security startups. Push states that CrowdStrike bought Seraphic and Jamf acquired Keep Aware in 2026, BankInfoSecurity reported Jamf’s purchase of Keep Aware, and Futurum analyzed CrowdStrike’s definitive agreement to acquire Seraphic. Those vendors can now offer browser security alongside products their customers already use.

Push’s three co-founders still run the company as CEO, CTO and CPO. Push says its leadership team is ex-MWR InfoSecurity and Duo Security, and Duo’s co-founders invested in its Series A, according to TechCrunch. Companies House records Push Security Ltd as an active UK private company incorporated on 12 November 2019.

Push’s researchers have a record that independent outlets report. BleepingComputer reported that Push discovered ConsentFix, an attack that steals OAuth authorization codes, in December 2025. BleepingComputer also reported that Push discovered a campaign of fraudulent OpenAI organization invitations in June 2026. Researcher John Hammond later developed a second version of ConsentFix, according to BleepingComputer.

Push’s team credentials in the cited record are its security-industry experience and its research output, and the record documents no prior founder exit. Push’s chief revenue officer, Kevin Arsenault, was part of CrowdStrike’s early sales team.