In short: Check Point Enterprise Browser is a Chromium-based secure browser in the Check Point SASE suite. Users install it on personal or contractor devices, and corporate web sessions run in an isolated workspace that is wiped when the session ends. Administrators control copy and paste, uploads, downloads, printing and screen capture, check device posture without an agent and audit sessions.
What Enterprise Browser is
Enterprise Browser is Check Point's answer to the unmanaged device problem. Personal laptops, contractor machines and agency PCs often need access to a handful of corporate web applications, but you cannot install your full security stack on them, see their security posture or stop data being copied off them.
Enterprise Browser is a separate, Chromium-based browser that users install on the device. Check Point's admin guide says it is built on SURF Security technology and integrated with Check Point SASE, with single sign-on and zero trust access. Corporate sessions run inside an isolated secure workspace, separated from the user's personal browsing and files, and when the session ends, sensitive corporate data is wiped from the device. Because it is Chromium-based, web applications behave as they would in Chrome or Edge. It is aimed at unmanaged devices but supports managed ones too.
Key capabilities
| Capability | What it does |
|---|---|
| Data isolation | A secure browser container keeps corporate apps and data separate from the device's operating system and personal environment |
| Session wipe | Removes corporate data from the device when the browsing session ends |
| Integrated DLP controls | Blocks or controls uploads, downloads, copy and paste, printing and screen captures; files can be encrypted and scanned before access |
| Watermarking | Adds on-screen watermarks to discourage photographing or sharing sensitive content |
| Credential protection | Password managers are blocked and credentials are not stored on the device |
| Agentless device posture check | Checks anti-malware, disk encryption, operating system and running processes before granting access, without a persistent agent |
| Session visibility and auditing | Logs navigation, usage, keystrokes and system metrics, with session recording, for compliance and incident investigation |
| Untrusted network protection | Defends sessions against man-in-the-middle attacks on insecure networks |
| Privileged user controls | Keyboard logging prevention, copy and paste restrictions, watermarking and session monitoring for admins and developers |
Enterprise Browser works with the agentless access option in Check Point SASE Private Access, so users can reach private web apps as well as SaaS without a VPN or agent, with access tied to their identity in Check Point SASE.
Use cases
| Use case | How Enterprise Browser helps |
|---|---|
| Third-party contractors | Temporary, controlled access to specific applications, with download restrictions, sessions monitored in real time and access ended immediately if something looks wrong |
| BYOD in regulated sectors | Staff can use personal devices while corporate data stays inside the isolated workspace with audit logging, supporting data protection obligations under UK GDPR and, for organisations operating in the EU, NIS2 |
| Privileged users | An extra layer of control and monitoring for administrators, developers and support teams working on sensitive systems |
| Mergers, acquisitions and temporary staff | Access for new joiners, project staff or third parties before their identities and devices are provisioned |
It is particularly useful where your alternative would be shipping a laptop to every contractor or accepting that their unmanaged device sees your data.
Enterprise Browser vs Harmony Browse
The names are similar but the products are different, and it is a common source of confusion.
| Check Point Enterprise Browser | Harmony Browse (Check Point Browser Security) | |
|---|---|---|
| What it is | A separate secure browser the user installs | An extension added to the user's existing browser |
| Main purpose | Safe access to corporate apps from unmanaged devices | Protecting users from phishing, malicious downloads and data leaks as they browse |
| Typical devices | BYOD, contractor and third-party devices; managed devices are also supported | Managed corporate devices, and some unmanaged ones |
| Data isolation and session wipe | Yes | No; it protects browsing in the user's normal browser |
| Part of | The Check Point SASE suite | Workspace Security; browser protection is also built into Harmony Endpoint editions |
If your aim is to protect staff on company laptops as they use the web, look at Harmony Browse or Internet Access. If your aim is to let devices you do not control reach your apps safely, Enterprise Browser is the right tool.
Deployment and licensing
Administrators create an application access policy in the Check Point SASE administrator portal, define which applications are available, which DLP controls apply and which posture checks a device must pass, then give users the download. Users install Enterprise Browser, sign in, and see the applications their policy allows. Because there is no persistent agent, it suits devices you cannot or should not manage.
Enterprise Browser is part of the Check Point SASE suite, which is licensed per user. Check Point's packaging changes over time, so we will confirm how Enterprise Browser is licensed for your users when we quote. See Harmony SASE pricing for the general model.
How Forever Systems helps
We identify which users and applications genuinely need unmanaged-device access, set DLP and posture rules that are strict enough for your data but workable for users, produce simple instructions for contractors, and monitor and adjust policies once live. Contact us to discuss secure BYOD and contractor access.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point Enterprise Browser?
A Chromium-based secure browser in the Check Point SASE suite. It gives unmanaged devices access to corporate web applications inside an isolated workspace, with DLP controls, agentless posture checks and session auditing, and wipes corporate data when the session ends.
Is Enterprise Browser the same as Harmony Browse?
No. Enterprise Browser is a separate browser for accessing corporate apps from devices you do not manage. Harmony Browse, now Check Point Browser Security, is an extension that protects users in their existing browser.
Does Check Point Enterprise Browser need an agent?
No persistent agent is needed. Users install the browser itself, and it checks the device's anti-malware, disk encryption, operating system and running processes before granting access.
Can Enterprise Browser stop users copying data?
Yes. Administrators can block or control copy and paste, uploads, downloads, printing and screen captures, and add on-screen watermarks. Password managers are blocked and credentials are not stored on the device.