Zscaler Purchases SquareX to Secure Browsers Without Agents

Zscaler acquired a browser security startup led by the former CEO of Pentester Academy to give organizations device posture checks and data loss prevention redaction.

The San Jose, California-based cloud security titan said its buy of Silicon Valley-based SquareX gives customers stronger browser-based security capabilities without the operational burden of installing agents or deploying full standalone enterprise browsers, said CEO Jay Chaudhry. SquareX allows security policies and enforcement to remain centralized in the cloud rather than distributed across endpoints.

“Customers started telling us, ‘Give me a couple of features like posture check using a standard browser, then life will be wonderful,'” Chaudhry told Information Security Media Group. “And we found SquareX, which had done exactly that. Essentially, they’ve built hyper objects for browsers. These are extensions in the browser which allow you to add functionality to the browser.”

SquareX, founded in 2023, employs 80 people and has raised $26 million, having last completed a $20 million Series A funding round in April 2025 led by SYN Ventures. The company has been led since its inception by Vivek Ramachandran, who spent nearly seven years as founder and CEO of subscription-based cybersecurity training platform Pentester Academy before it was bought by INE in October 2021 (see: The Inadequacies of Secure Web Gateways in Modern Security).

Why Customers Don’t Want Agents or Enterprise Browsers

Zscaler customers consistently communicated a desire for stronger browser-level security controls while continuing to use standard browsers, with customers increasingly resisting installing agents or adopting fully separate enterprise browsers, Chaudhry said. SquareX stood out because it had built lightweight browser extension technology that delivered these features while remaining compatible with Zscaler.

“Customers started to tell us, ‘Hey, there are third-party browsers coming out, and they can access certain applications,'” Chaudhry said. “And we said, ‘You can do that today with a standard browser for Zscaler Private Access.’ They said, ‘That’s true, but I don’t want to install an agent. I still want to have posture check on the device. I want to do some DLP and redact some of the stuff that’s coming down.'”

Complexity at the endpoint is no longer acceptable to many organizations, Chaudhry said, with agents requiring installation, updates, troubleshooting and ownership decisions. And standalone enterprise browsers must be deployed, supported and maintained like any other major application, with browsers today resembling operating systems with enormous codebases and constant vulnerability disclosures.

“These Chromium browsers have tons of vulnerabilities,” Chaudhry said. “If you research and say, ‘How many browser vulnerabilities Google is fixing every day?’ it’s a big number. So, why is the number big? The browser code itself is, I understand, a billion lines of code. They become big, like operating systems. The bigger the code, the more likely it’ll have vulnerabilities.”

While agents provide deep visibility and control, Chaudhry said they introduce management complexity, upgrade challenges and trust concerns, particularly when dealing with third parties. SquareX’s browser-extension-based approach is easier to deploy, simpler to manage, and dramatically lowers the friction of granting access while still providing meaningful security signals such as device posture, Chaudhry said.

“The problem is you have to expose applications to the internet,” Chaudhry said. “That means you have an attack surface. The benefit they get is they get device posture and can do data redaction, but they’re doing this to the endpoint device. Policy is local. Enforcement is local on the endpoint. We don’t want policy enforcement all happening on every endpoint. We want endpoint to be very lightweight.”

How SquareX Can Help Companies Redact Sensitive Information

Historically, organizations relied on VPNs or VDI to support third-party or BYOD access, but VPNs expand the attack surface and implicitly trust devices, while VDI is costly, slow and widely disliked by users, he said. ZPA granted application-level access without exposing networks, but clients still wanted assurance about the security posture of the connecting device and control over how sensitive data was handled.

“We are essentially strengthening the solution that we have in place with a couple of these key features, one for cyber, one for DLP,” Chaudhry said. “By adding this simple feature, we think our customers will be happy. And they will feel like they won’t need to do one more standalone browser that someone has to deploy.”

As collaboration with external parties increases, Chaudhry said organizations want the ability to share documents while selectively removing sensitive data rather than blocking sharing entirely. Instead of preventing documents from being shared, organizations can selectively remove sensitive elements such as financial figures, personal data or proprietary metrics while allowing the rest of the content to flow.

“Rather than stopping the entire document from going out, they may say, ‘Here are two pieces of sensitive information, certain dollars, numbers, figures, sales redacted, and I can share the rest of the information,'” Chaudhry said. “So, it’s becoming a pragmatic use case, and this feature is coming from the DLP policy we already have in place at a central level.”

Zscaler evaluated companies including Island and Talon years earlier but ultimately decided against acquiring them since Zscaler didn’t want to depend on third-party update cycles or compete indirectly with Google for vulnerability remediation, Chaudhry said. And CrowdStrike’s buy of Seraphic is more focused more on detection and visibility than on access enablement and zero trust enforcement, Chaudhry said (see: Seraphic Acquisition Arms CrowdStrike for AI Browser Threats).

“Imagine Google is spending so much time trying to keep up with it,” Chaudhry said. “Is Google going to go and help these third parties and say, ‘Hey, I found this vulnerability. I want to fix it tomorrow and give it to you.’ Not really. They compete with Google, actually. So, from that point of view, we did not want to be in a business where we can’t keep up with fixing these browser vulnerabilities.”