Browser Security Deals Top $1 Billion in 2026, All Betting on the Same Engine

Quick Facts

• CrowdStrike, Zscaler, and Akamai completed three browser security acquisitions in 2026, spending a combined total exceeding $700 million, following Palo Alto Networks' $625 million Talon deal in 2023.
• Every major enterprise browser security product on the market runs on Google's Chromium engine, creating a shared dependency that no enterprise controls.
• Island, the only large independent browser security company, reached a $4.85 billion valuation after raising $250 million in a Series E round led by Coatue.

The enterprise browser security market has absorbed more than a billion dollars in acquisitions over the past three years. The products those deals produced all run on the same code, according to a VentureBeat analysis published Wednesday.

CrowdStrike, Zscaler, and Akamai each bought a browser security startup in the first half of 2026. None of the acquired products moves away from Google's Chromium rendering engine. Extensions, policy overlays, runtime instrumentation, and hardened Chromium builds all still execute untrusted web code on the endpoint.

The Deals

CrowdStrike acquired Seraphic Security in January for approximately $400 million in a mix of cash and stock. Seraphic, founded in 2020, had raised $37 million from investors including CrowdStrike's own Falcon Fund. The deal was CrowdStrike's fourth acquisition since August and its second in under a week.

CrowdStrike President Michael Sentonas framed the acquisition as a way to correlate endpoint signals with browser telemetry. Chief Business Officer Daniel Bernard said employees now spend 85% of their workday in browsers, making the browser the primary gateway for AI agents and generative AI applications.

Zscaler closed its purchase of SquareX on Feb. 5 for $112.8 million in cash plus $37.4 million in restricted stock, according to the company's fiscal 2026 Form 10-K filed with the SEC. CEO Jay Chaudhry said the deal extends Zscaler's browser capabilities to unmanaged and BYOD devices without requiring a third-party enterprise browser.

Akamai paid $205 million in cash for LayerX Security in July, according to SEC filings. The company rebranded the product as Akamai Workforce Protector. At the time of closing, LayerX's annual recurring revenue was forecast to reach roughly $10 million by year end. Akamai's security chief said customers are adopting AI at record speed and existing controls cannot see how employees interact with AI tools or what data they share with large language models.

Palo Alto Networks set the template in December 2023 when it completed its $625 million purchase of Talon Cyber Security. Talon's product is now Prisma Browser, a managed Chromium build with data loss prevention and zero-trust access controls aimed at contractors, BYOD users, and remote workers.

One Engine, No Exit

Shioupyn Shen, founder and CEO of CloudMosa, argues the buying spree has obscured a structural risk. Every product in the enterprise browser security market inherits Google's rendering engine, its patch schedule, and its long-term roadmap decisions.

"Most enterprise browser security products run on the same Chromium code, and AI-assisted vulnerability discovery is exposing Chrome bugs at a steeply accelerating rate," Shen said. "No vendor has funded an alternative execution architecture that enterprises could switch to if that code fails."

Buying from multiple vendors does not reduce that exposure. Each vendor's product traces back to the same upstream codebase. A critical Chromium vulnerability would affect the entire market simultaneously.

"When the giant falls, you fall with the giant," Shen said. "Chrome is a strong foundation. The problem is that the entire industry is building on essentially the same foundation without a meaningful Plan B."

Island Stands Apart

Dallas-based Island is the largest independent player and has not been acquired. The company raised $250 million in a Series E led by Coatue, valuing it at $4.85 billion and bringing total funding to $730 million. Backers include Insight Partners, Sequoia, and Canapi Ventures.

CEO Mike Fey said seven of the 10 largest financial institutions in the world are Island customers. Island's product is also built on Chromium, but its independence means the company sets its own roadmap rather than fitting a browser product into a broader platform strategy.

The concentration risk is not theoretical. As AI agents move more corporate workflows into the browser, the attack surface grows. An industry that spent more than a billion dollars on browser security still has no funded alternative if Google's engine becomes the source of a major breach.