Push Security

• Enterprise-browser vendors (Microsoft Edge, Chrome Enterprise) or identity platforms could add native browser telemetry and identity detection, absorbing Push's core into products the buyer already owns.
• Most named references are security-native or developer-tooling companies, so Push has not yet publicly proven adoption across mainstream enterprises that define the category's larger market.
• The headline traction figures (1.5 million endpoints, 380 percent growth) all date to the April 2025 Series B, so a reader cannot confirm from public sources whether that trajectory held.
• Public technical validation beyond the SaaS attack matrix is thin, so capability and detection-accuracy claims rest largely on vendor pages a competitor could match with marketing.

Push targets a pain that traditional identity tooling cannot see: identity attacks that play out inside the browser, where employees log into SaaS apps, get phished, and have live sessions hijacked. The company pitches the enterprise security team directly, framing the browser as the new control point for workforce identity.

The pain is specific and corroborated rather than a marketing generality. Press coverage of the Series B frames identity as the dominant breach vector and points to high-profile breaches built on stolen credentials and session tokens, the exact attack class Push detects in the browser session.

The positioning leans on a real shift: work and identity have moved into the browser and SaaS, so attacks that older identity and endpoint tools miss now surface there. Push argues the browser is where these attacks become visible and stoppable in real time. [s1, s4, s5]

The product is a single browser extension that collects browser telemetry, applies controls that act instantly, and runs detection agents continuously. It targets a named set of browser-delivered attacks: adversary-in-the-middle phishing proxies stealing session tokens, ClickFix-style social engineering, malicious OAuth integrations, malicious browser extensions, ghost logins that bypass single sign-on, and credential stuffing.

Because the control sits inline in the browser session, Push can block some of these attacks in real time rather than only reporting them, which distinguishes it from posture tools that discover and govern SaaS identities after the fact. It also maps the identity attack surface, flagging stolen credentials, missing multi-factor authentication, and non-single-sign-on accounts.

The public evidence is concrete on what the product does but thin on independent technical validation. The strongest external artifact is the open-source SaaS attack matrix, a repository of SaaS-native attack techniques that researchers and red teams use, which substantiates the threat model the product defends against. [s2, s1, s5, s10]

Push helped define browser-based identity threat detection, but the space it opened has crowded quickly. Grip Security added an ITDR layer that detects malicious OAuth grants and browser extensions, Unixi sells browser-delivered universal single sign-on, and enterprise-browser vendors pitch the same browser-as-perimeter thesis from the platform side.

Push's differentiation is the inline browser extension paired with its research output. The SaaS attack matrix is an open-source taxonomy of SaaS-native attack techniques, and security researchers, red and blue teams, and penetration testers worldwide use it, so Push stays visible in the practitioner community.

The structural risk is absorption. Browser telemetry and identity detection are capabilities Microsoft Edge, Chrome Enterprise, and large identity platforms can build natively into products the buyer already runs, so Push's durability depends on whether its research flywheel and detection accuracy stay ahead of native platform coverage. [s1, s2, s5]

The traction evidence is strong for the stage but concentrated around the April 2025 Series B. At that point press reported 1.5 million endpoints deployed globally and 380 percent year-over-year customer growth off an undisclosed base. Redpoint Ventures led the round, Datadog Ventures and B3 Capital participated, and existing investors including Decibel and GV joined.

Named references anchor the claims. The trust portal lists GitLab, Cribl, GreyNoise, Risk Ledger, Upvest, Thinkst Canary, and PortSwigger as customers, stronger proof than anonymized logos. Notably, most of these are security-native or developer-tooling companies, the buyers most ready to deploy a browser agent fleet-wide.

Published pricing reinforces a clear go-to-market: 5 dollars per user per month for organizations up to 500 employees, with negotiated enterprise terms above that, a transparent per-seat motion that lowers the buyer's evaluation friction. [s4, s5, s6, s7, s8]

The founding team carries verifiable offensive and defensive security heritage. The company states its leadership comes from MWR InfoSecurity with Duo Security and CrowdStrike backgrounds, pedigrees in exactly the identity and endpoint domains Push now sells into.

The research output substantiates the team's standing beyond titles. Push contributed the open-source SaaS attack matrix, a repository of SaaS-native attack techniques used by security researchers, red and blue teams, and penetration testers, which is a community-facing research asset rather than a one-time disclosure.

The commercial bench deepened with the Series B. The company added a chief revenue officer drawn from prior enterprise security sales leadership, signaling an intent to scale an enterprise go-to-market beyond founder-led selling. [s3, s5, s4, s9]

Push publishes an inspectable trust portal at trust.pushsecurity.com rather than only self-displayed badges. It lists gated compliance documents including a SOC 2 Type II report, ISO/IEC 27001 and ISO/IEC 27701 certificates, a Cyber Essentials certificate, and a 2025 penetration test report.

The portal also documents product-security specifics relevant to a browser-extension buyer, including a browser extension attack model, extension permissions, and a browser event storage privacy overview, which addresses the natural objection that a fleet-wide extension expands the attack surface.

These are commercial attestations rather than a federal authorization or regulatory mandate, so they clear enterprise procurement hygiene without conferring a compliance-driven barrier to replacement. [s6]

Add analyzed competitors to compare them side by side with Push Security.

Push targets enterprise security teams contending with identity attacks that traditional identity and endpoint tools miss, the phishing, session hijacking, and credential attacks that play out inside the browser. The control point is the browser session where employees authenticate to SaaS.

The published references skew to a specific segment: security-native and developer-tooling companies such as GitLab, GreyNoise, Thinkst Canary, and PortSwigger. These references suggest early adoption among security-forward buyers, where deploying a browser extension fleet-wide may face less cultural friction than in a less security-mature enterprise.

The narrowing question is whether that early-adopter base generalizes. The browser-as-perimeter pain is horizontal, but the demonstrated adopters are the most security-forward end of the market, so the segment Push has proven is narrower than the segment it addresses.

Push collects browser telemetry, applies controls that act instantly, and runs continuous detection agents from a single extension. It targets a named set of browser-delivered attacks: adversary-in-the-middle phishing, session hijacking, malicious OAuth integrations, malicious extensions, ghost logins that bypass single sign-on, and credential stuffing.

Because the extension sits inline in the browser session, Push can block some attacks in real time rather than only reporting them, which is a stronger operating position than posture tools that discover and govern SaaS identities after the fact.

The strongest external substantiation is the open-source SaaS attack matrix, a repository of SaaS-native attack techniques used by researchers and red teams. It documents the threat model the product defends against, though the reviewed record includes no independent validation of the product's own detection accuracy.

Push sells a transparent per-seat motion: 5 dollars per user per month for organizations up to 500 employees, with negotiated enterprise terms and volume discounts above that. Published pricing lowers buyer evaluation friction and signals a product-led, mid-market-friendly entry rather than a purely gated enterprise sale.

The traction is real but concentrated around the April 2025 Series B. Press reported 1.5 million endpoints deployed globally and 380 percent year-over-year customer growth, and the round drew Redpoint Ventures and Datadog Ventures.

The commercial bench deepened with a chief revenue officer drawn from prior enterprise security sales leadership, signaling intent to scale beyond founder-led selling, though the named references remain weighted toward security-savvy early adopters.

Push charges by the seat, 5 dollars per user per month up to 500 employees, which tells the buyer it prices the protection of each workforce identity rather than data volume or app count. The unit matches how a security team sizes identity coverage.

Publishing the price at all is a positioning choice. It gives self-serve and mid-market buyers a price they can evaluate, though the pricing page also routes buyers to a demo, so the motion blends transparency with sales contact.

Above 500 employees the motion converts to negotiated enterprise deals with volume discounts, so the published rate is an entry anchor rather than the enterprise reality, but it still reduces the friction of a first purchase.

Push delivers as software the customer installs and operates, a browser extension deployed across the workforce that runs telemetry, detection, and inline controls. The customer's security team configures policies and consumes the detections and blocks the product produces.

The operational value is real-time prevention and identity attack-surface visibility, not an outsourced security operation. Push does not present a managed-service layer that takes accountability for outcomes the way a managed detection provider would.

Because the customer runs the extension and acts on its output, the delivery model is standard enterprise software. That shapes the value-delivery and switching analysis below: the product is the detection-and-control capability, not an operated service.

Push publishes an inspectable trust portal at trust.pushsecurity.com rather than only self-displayed badges. It lists gated compliance documents including a SOC 2 Type II report, ISO/IEC 27001 and ISO/IEC 27701 certificates, a Cyber Essentials certificate, and a 2025 penetration test report.

The portal also documents browser-extension-specific security artifacts: an extension attack model, an extension permissions overview, and a browser event storage privacy overview. These directly address the objection that a fleet-wide extension expands the attack surface and captures sensitive browsing.

These are commercial attestations rather than a federal authorization or regulatory mandate. They clear enterprise procurement hygiene but do not, on their own, block a buyer from replacing Push with an alternative.

Push says it supports all popular browsers, including AI and enterprise browsers, through its browser-extension approach, which positions it as an overlay on the browsers an organization already runs rather than a browser replacement. That breadth is reach, not a measured integration moat.

The same architecture is the exposure. The browsers Push extends, and the identity platforms it complements, are the actors most able to absorb its telemetry and detection natively into products the buyer already owns.

Public materials do not quantify a marketplace presence, integration count, or partner program that a well-funded copycat could not match, so the ecosystem reads as a distribution surface rather than a defensible position.

The founding team carries verifiable offensive and defensive security heritage, with leadership stated to come from MWR InfoSecurity and backgrounds spanning Duo Security and CrowdStrike, pedigrees in the identity and endpoint domains Push sells into.

The research output substantiates the team beyond titles. Push contributed the open-source SaaS attack matrix, used by researchers, red and blue teams, and penetration testers, which is a community-facing research asset rather than a single disclosure.

The gap is a demonstrated prior exit in this category. The credibility comes from pedigree and a respected research artifact rather than a completed build-and-sell cycle in browser or identity security.