Soap Box: Security must be more browser-centric

0:03Patrick Gray: Hi everyone and welcome to this special Soapbox edition of the Risky Business Podcast. My name's Patrick Gray. For those of you who don't know, these Soapbox editions of the show are wholly sponsored. So that means everyone you hear in one of them paid to be here. And today we're chatting with Adam Bateman, who is the CEO and co-founder of a company called Push Security. Now I am an advisor to Push Security. That means I've got some share options in them. And in fact, from now on, the only companies you're going to hear in these soapboxes, I think from next year, are going to be companies that I do advisory for, right?

0:37Patrick Gray: That's just the way things have worked out. So this is a company I know well. It's a company that you would have heard me talk about a lot on the show because I really like what they do. So the guts of the Push Security product is a browser extension that sits in the browser. And it can do things like phishing prevention, right? It can stop things like click fix attacks and whatever. All of the stuff that mail gateways used to catch but can't quite catch anymore because phishing crews obfuscate stuff, Push catches that. Also stuff delivered via the browser, right? Stuff like this click fix, consent fix, those sorts of threats well and truly captured by Push.

1:16Patrick Gray: But they really started off as like this identity security play that, as you'll hear, Adam says, well, no one really cared about at the time. doing an inventory of where staff are signing up for accounts and that sort of thing. And then evolved into this sort of anti-phishing control. But this interview is really about like, well, okay, once you're in the browser and you're doing this sort of stuff, what happens if you add like a client to run the machine as well and you can have messaging between the browser extension and the client, you can start doing DLP stuff, you can start doing secure web gateway stuff, even just with the extension there.

1:52Patrick Gray: The whole point of this conversation is like, well, once you start being very browser-centric in your thinking, what other use cases flow from there? And as you're going to hear, Pusher doing a push into DLP. And they're also doing a push into the secure web gateway kind of thing. Because why do you want to trombone all of your traffic through a Zscaler product when you could just have a browser extension that does the same thing but better? so here is Adam Bateman talking about I guess kicking things off with you know a discussion of where the product came from and then we talk about where it's going I found this a very interesting conversation and I hope you enjoy it too cheers way back in time we started off doing SaaS discovery and no one gave a shit about that basically at the time we were really early and I think at the time there was like you know SSPM category we didn't care about categories we never really went anywhere but it was like we knew that people taking company data and stuffing it into lots of random distributed sass applications was a problem and it was going to be a problem so we just focused on that but yeah like it turned out i mean yeah that's true like the early the early interviews we did it was all about like well you can find out where your users are registering accounts you can see that they've got like um unsanctioned stuff going on and as much as like okay people didn't care they kind of really care at the moment about rogue ai and using a browser extension like yours is a good way to find that but go on exactly that yeah yeah well that's exactly my point right is that we knew this was a huge problem and we were talking to people like fintechs and really modern people that knew this was a problem but it turned out like timings everything and startups and so when we sort of started out the mass market didn't know that this was a huge problem and then a few years later what happens is this entire product gets It's reincarnated as AI applications, which, what are they?

3:41They're just SaaS applications, really. That's ultimately kind of what they do. So by now, we've become very, very good at this problem. We can see all the identities that are logging in. You can see if someone's logging in with a personal account. You can see if people are logging in with a business account. You can even see much, much deeper into what prompts people are pushing into those and everything else. So it made a ton of sense. We really nailed the threat detection side, like the threats coming into the browser. It made a lot of sense for us then to start focusing on the kind of egress side and where people are putting company data.

4:10So big driver for a lot of the reasons that people use us now is exactly that. Like someone's got ChatGPT, they're stuffing loads of company data into it, they're control A-ing and then pasting that stuff in. You can see everything at a prompt level and you can prevent all that stuff and sort of log it all back into the sim for forensics later on.

4:26Patrick Gray: Yeah, it's funny, right? Because I had some really amazing chats with a mutual friend of ours about doing DLP sort of at that browser level. and there's a lot you can do. There's like a handful of detections that you can use when you've got access to the browser where you can just cover so much. You can just cover so much. I mean, is that what you found as well when you've been building out this product? Yeah, I can see the grin on your face because you called this like 18 months ago and here we are building it. I will say just for anyone who's wondering what that comment's about is like, Like I did suggest to Adam a couple of years back that building a DLP feature like this into the product would be a good direction, but he did not want to do it.

5:15Patrick Gray: But that's because you were busy building all the other cool stuff, right? So it made sense. Yeah, we were busy deflecting all the threats. But yeah, no, I mean, I think the granularity inside the browser, you can just see a timeline. I think of it a lot like going back to the threat detection routes from it. It's a bit like network IDS and EDR type paradigm. like when you're on the wire you can see all of this stuff right you can see like someone connecting out to dot ru and something bad happening or whatever but obviously attackers then just do stuff like they go okay well i'm gonna set my command and control server to be like a google doc and therefore the the beaconing goes out to docs.google.com and that's not bad and then it gets around the network ideas and all these things just constant cat and mouse all the time but when you move back close to the user there's just a ton more stuff that you can detect and it's actually a lot more expensive for the attacker or the user to get around it because you're actually detecting and stopping fundamentals.

6:09It's very much the same with a browser extension, right? Like when you've got these kind of sassy platforms and other stuff and you're doing stuff off the wire, when you're inside the browser, you can see stuff a lot more granularly. So you can actually see an upload and you can say, yeah, but this upload is happening on a personal account. So I want to stop that blank. Whereas this one is happening on a business account and therefore or maybe I want more granular controls. Like I will allow it as long as it's in the kind of corporate tenant of ChatGPT and not some other one. And you can get much more fine-grained with it.

6:42So you can go a ton deeper when it comes to these sort of controls, like being the browser is advantageous. And you don't have to do like break and inspect, for example, which obviously gets really messy.

6:50Patrick Gray: Well, that's the whole point you're making about like on the wire versus from the endpoint. I think there's so many, like the fact that people still sell break and inspect products in 2026 is just mind-boggling to me. You really do need to be at the endpoint for all of the reasons that you're saying. You know, like I think even the, like how are you going to stop phishing on the wire? Yeah. Like how is that, you know, like how are you going to stop it either from intercepting mail, right, and inspecting mail or trying to do that on the wire just by looking for known malicious domains or IPs? Like it's just not something that has even a hope in hell of working at all.

7:28Exactly, yeah. and honestly there's some really good examples of that like um click fix we can talk about in a bit more detail later but just sort of sort of headline if you think about how you actually stop something like that like you're seeing now people host stuff on completely legit domains that then redirect off through multiple chains then hit this sort of phishing link later on and they're they're like there's like a two-day lifespan on some of those phishing domains so they they just cycle out continuously it's almost impossible on the wire to pick up with that stuff and so like actually looking for a known bad domain is all it sucked for a long time but it sucks even more now given the fact people can move much much quicker with vibe coding and stuff

8:05Patrick Gray: well i will say i will say i have i have felt some sympathy uh for a criminal who was trying to socially engineer me over the phone they had rung me up and i was recording them i remember i played a little bit of clip i don't know if you remember this but i played a little bit of the clip of this guy at the point where i'm like well i should let you know that i'm i do a cyber security podcast for a living and you know, you're going to be on it. And he was like, yeah, he didn't believe me. And it was actually pretty funny. But what was really funny, like, it's funny what you say about like the typical life cycle of one of these phishing sites is he gave me a phishing URL and I'm like, I'm going to load this up.

8:37Patrick Gray: I want to see what he's trying to do. And it didn't 404, it like wouldn't even connect. Right. So these guys, like, it's actually difficult even for them to get infrastructure that's going to survive long enough for them to even get someone to hit it right so this stuff is very very very ephemeral yeah 100 and then that's why you have to get deeper remember the pyramid of pain thing we were talking about and like you were saying it's like really easy to detect like iocs and in bad domains but it's also really easy for attackers to flip whereas when you start like stopping fundamental techniques like you know with in the edr world like something injecting into memory or whatever it's much more expensive you have to rewrite your malware to get to it it's kind of a very similar thing here right so like you take click fix as an example, rather than looking for a known bad domain.

9:22Patrick Gray: Yeah, I mean, it sticks out in the browser, right? Like it's so obvious. Yeah, exactly. You need to look for the actual commands. Exactly. And so like, so if you're on the wire and you're doing something with like a swig, then you're in a situation where you're going, okay, well, this might be click fix. Let me break and inspect, analyze the DOM, figure out it's got PowerShell on it, and I'll block that. Now what happens? You end up with loads of false positives from doc sites and the amount of crazy stuff that happens on the internet is almost impossible. If you move back into the browser, what you can say is, show me any malicious commands that are entering the clipboard.

9:56And at that point, you're narrowing the field so much that it just becomes so much more high fidelity. And you can look in the context of where did it come from. So you can go like, hey, a user clicked on a sponsored Google ad, which went redirected through like a sites.google.com or like Microsoft Dynamics or whatever it might be, and then landed on this place, which injected something into the clipboard. That context just gives you much, much higher fidelity detections. You can't get off of the wire.

10:23Patrick Gray: No, no, 100%. And I think, look, DLP is the same, right? Let's bring it back to the DLP conversation because I think if you look at how you want to stop, how you can stop 80 % of data breach incidents involving an insider, it's zip file going into a personal Gmail account. if you can detect block that lock the user's account you have just stopped 80 percent of incidents like it is really crazy like you know we always talk about the well i always i can't even remember who gave me this metaphor to begin with but the you know the rocks in the jar so you start by filling up the jar with big rocks and you can only squeeze so many in so then you start putting in some smaller stones and then some pebbles and eventually sand you know these very basic primitives here like blocking a large zip file into a personal gmail that's one of your rocks right there and you can fill up most of the jar with these big rocks and there's it's not too many of them yeah for sure and like honestly a lot of the stuff you can do as well just through access control if you imagine someone's default state with ai usage they're sitting there with their hair on fire border telling them you need to adopt ai as quickly as possible but yeah i also don't want our company data being stuffed into all these apps all over the place but that's people's default state so if you like some of one of our oldest features was just basically see what apps people are signing up to and with which identity they're signing up to.

11:42Immediately, you can just go, right, these are all the apps that are being used. You can just go click, filter, buy AI category, and you can see everything. Mark them as approved and go, like, those are the ones that are allowed. Block, deny everything else. And then in the browser, there's a control that says you are not allowed to access DeepSeek or ChatGPT. You can only access Claude and Copilot or whatever you choose, you know, your weapon of choice inside the business. and then once you're in that point you can then say okay now users are only hitting those domains but obviously within your say Claude or whatever someone could sign up to a personal account or a business one so then you can say deny you can actually get as granular now to say do not allow a login if it's in a personal account and it's a password login like only if it's SSO for example so then you can literally only log in if it's on SAML if it's on the corporate account and you're in and then once you're at that point you people often show a little banner at the top to say here's our ai policy please accept it to sort of pass the liability back and they've done their part but then as you know users read they forget they then end up with like a ton of other like you know they just get on with their day and they focus on productivity again so then being able to get into the granular controls and actually say okay well now you're in this authorized account on an authorized tenant i'm only going to allow uploads of this type of data and making sure that you can say like, no, you can't copy paste this GitHub access token into this tenant and you can block that stuff at that level.

13:10And you just can't do that without being that close to the user and actually seeing the clicks and events.

13:15Patrick Gray: This is what I was going to say, right? Like you look at the way CASB, like the reason I never talk about that, the reason I've never had a CASB sponsor is because that stuff is just mega jank. Yeah, it's hated, man. it's so bad it's so bad and then you know you mentioned it and you use an acronym that i don't even know that i didn't even know until we were talking about it earlier and i guarantee you most of the audience doesn't know which is swig which stands for secure web gateway right so the product is you know you've got companies like funnily enough i'm pretty sure this was their first product uh companies like zscaler um i the the earliest products i remember zscaler selling was secure web access.

13:59Patrick Gray: So the idea was when everyone was getting owned by like drive-by exploits and stuff, they're like funnel all of your web browsing traffic through our gateway that's going to do break and inspect and clean, well, not even break and inspect back then because there wasn't much TLS out there. The idea was it would just, you know, inspect web traffic, make sure everything was okay, make sure there were no exploits coming down the pipe and popping browsers and, you know, just things like that. That's how it worked. Now that was a good product. And at the time, but that was like 15 years ago, you know, like I think we've moved on from that a little bit.

14:31Patrick Gray: And now this is something you're doing, which is making a push towards trying to, you know, chip away at that market with your product. Why don't you tell me, like, what features did you need to add and how did you need to think about all of that in terms of like, you know, being able to displace some of these companies? You know, God bless them, but their time has come. The time has come that they need to be, they need a bit of competition, I think. Yeah, for sure. Yeah, I mean, like Swig and Casby, like Casby, you're sharing the sentiment of a lot of the industry there. So there's going to be a lot of people nodding.

15:02Like people just don't love Casby. It's really, really old school. And Swig's now falling into that same category for sure. I think it's like, you know, this market, this browser security market is like disrupting that Swig and Casby type market. quite aggressive and i'd love to sit here and say like i had the foresight years ago this was going to happen but actually we kind of got pulled into it so like yeah security practitioners we don't care about categories we don't think about like that we think about real problems getting in front of the customer what pain are you suffering and how can i take that away from you and we've built use cases that really matter to the industry bit by bit and that's how we've managed to get the growth and the success that we've had but then gradually as we've started to like run alongside like there's no one that doesn't have a swig and casby of some kind and so we're running adjacent to them and initially people were just like oh my god there's so much stuff getting through that you catch because we're sort of like we're we're in gold right like oh my god this one this one works yeah exactly yeah so we're just like the fact that we can detect anything like show shows how old school all that stuff's become but then what's happened is as we built up a lot of customer loyalty people have kind of said to us like well hang on a sec like if you just sort of turn 20 degrees to the right do i need to even renew my swig and casby anymore because you kind of do most of the stuff like so much stuff happens in the browser you know 85 or something of the traffic now is like is is encrypted or probably more these days and i have to break and inspect everything there's even stuff in you know if you look at zscaler's documentation that literally says you know exclude microsoft 365 because it breaks stuff and microsoft has that in their documentation as well but a lot of attackers are hosting you know attack payloads there and and that's a big problem for dlp so there's all this different stuff happening so yeah then people started saying to us you know look can you build these other features that was one of the things that pulled us into the sort of dlp route we we recently implemented like a domain categorization feature like an add-on which does exactly that does web filtering and you can just literally just the you can or cannot access weapons site or uncategorized domains it's not exciting stuff But it's just stuff that because we're able to do a much more modern version of it, because rather than backhauling all the company traffic.

17:13Patrick Gray: This is so satisfying. This is so satisfying for me because like a couple of years ago, you were like, I don't want to build DLP, man. We just want to build cool stuff. I know, man. Because it's boring. It's boring. But there be money, my friend. There's like big old fat piles of cash because everybody who does it, well, not everybody does it, but most people who do it, it's an infuriating user experience. A lot of the time you're talking about an actual endpoint agent that was developed. That thing was acquired from a small company in 1998 and half the code base is still from the 90s. You know what I mean?

17:50Patrick Gray: This stuff is often quite bad. It's not properly integrated with the browser. It's just, as I think the words I used earlier to talk about CASB is mega jank. And I think the DLP stuff is like that as well. I mean, I still remember that RSA conference years ago where DLP was the hot thing. But I think the stuff that's really succeeding these days is the stuff that is closer to the browser. What sort of customers are you picking up with that? Is that like they want to churn away from their existing DLP towards you? And do you license that as like an extra module? How have you handled that? Yeah, so at the moment, we keep everything in a sort of central base tip we're building out a brand new product skew to sort of upsell which is like a you know swig casby alternative so what we're doing at the moment is each time we ship a new feature we're putting that on as a kind of add-on which is like building towards this new product skew over time so the web filtering one that i mentioned is the first version of that and like you said it's not exciting but it's but there's really simple things you can do to just add a lot of advantage over the more legacy web filtering like because you're in the browser means that everyone gets native access to the internet full speed and rather than backhauling all your traffic through some data set which is really expensive and vendors pass all those costs on to you which is kind of crazy like you don't have any of that if you do the stuff on the client side so much much more seamless user experience it's much much cleaner And we've had people calling us up saying, look, I've got this sassy and it's sort of sending your information out through some exit node.

19:31And it keeps coming out in German because I don't have an excess node in my country. And it throttles my internet connection by 50 % and the controls aren't granular enough. So we just built something that was really native directly in the browser, way more granular controls. And actually one of the big drivers for people using that feature is that you can see the long tail of all the AI applications that people are signing up to, like things like Harvey AI, which is not like a Claude or a Gemini, but it's like heavy usage of AI inside it. And people like to have that long tail and that granularity of all those applications as well and that kind of stuff.

20:06So that's kind of the first one. And people have started to use that. So anyway, to answer your question on what type of users, generally speaking, like when you're in a very, very big company, like a big bank or something, there's two halves to a society. There's kind of the access control side that I know you know about. And then there's the sort of Swig and Casby side. And they tend to be owned by, you know, IT and security. And because you're straddling two budget items, it's a little more complex to do, like to do a full rip out there directly. But in sort of companies that are 10 ,000 and down, completely different.

20:38Like it tends to be like one team in one area. And so we've seen most traction in actually doing full replacements of SASE and that sort of 10 ,000 and down for now. But over time, we're building more and more and more features and we're actually getting more and more of a pull in big enterprise. We've had people using things like Cisco Umbrella, which is just like classic sort of DNS filtering. And just, you know, there we provide a much, much more modern equivalent of that. So yeah, 10 ,000 and down is what I would say is the mass area. but we've had like some pulling some big enterprise recently as we've been shipping more features of the answer.

21:10Patrick Gray: I mean, I get the investor updates, right? So I get to actually see how things are going. And I can tell everyone without revealing anything confidential that things are going rather quite well. It's funny you mentioned the access control bit, right? Because when you've got a lot of these, like you look at how people are getting known these days, a lot of it's the stuff at the edge, the Palo Alto networks, the Fortinets and whatever. and you know and I've kind of alluded to it on the show I'm actually co-founding a company at the moment that's trying to take a swing at that using a different approach right and also being very much about in the early stages enabling agentic access to company resources because no one in my view no one's done that properly yet and we've got an architecture that works and we're developing that at the moment the funny thing is though adding you know this architecture requires having what we're calling access points in your VPC or your data center or whatever to provision cloud-based AI apps with access to those databases and MCPs and whatever else you have in your VPC or data center.

22:16Patrick Gray: But what we've discovered is that adding the human access to that as well is actually really easy once you've done the heavy lift of actually developing that architecture in the first place. But what's staggering to me, and it's the same as this swig stuff that you're taking a swing at. What's staggering to me is like what we've put together on the remote access side and what we're developing there. It ain't rocket science. It's just that the incumbents have these markets so stitched up that like it discourages people from coming in and innovating, I think. So I think there is, there's money to be made and there's success to be had by just actually bothering to do the work of modernizing something that's quite well established.

23:02Patrick Gray: And I will say also that there are some startups, and I won't name them because I don't want to be seen to be like taking a swipe at them, but there are some interesting-ish startups in remote access. But the problem with them is that they are trying to just rebuild a slightly refined, slightly better, slightly more secure version of the existing paradigm, which I just think is kind of crazy when you can start with a clean sheet of paper, kind of like how you have with like, well okay you know starting principle get in the browser then what right and then the use case then the architecture sort of flows from there the use cases kind of flow flow from there am i rambling or am i making sense no it makes total sense man and you are completely right because i mean this is why it's interesting when you talk to startup founders like people kind of think oh well i can't go up against this enormous incumbent but people don't realize that they they suffer i mean you Innovator's dilemma is a really big thing, right?

23:57It's like you're in a situation where you've built such a heritage in one particular area and you're articulating the value of that for a decade or more that to suddenly disrupt your own technology is really, really difficult, right? Even if you're coming back to SWIG, if you're backhauling all of your company traffic, you have to have enormous data centers for that to happen. All the value of everything going through centrally in your sort of centralized cloud, that's very expensive and you have to pass those costs back on, right? If someone comes along with a sort of in the browser and it's like, you don't need to backhaul that traffic.

24:30We don't need to pass all that expense onto you. We can still build something really innovative and that's the situation. It's like, you can't go build that without actually kind of undermining all your current revenue. So you kind of get stuck. But all the time, the market is crying out for something that's a bit more nimble and a bit more native and a bit more modern. And so there's an avenue there, right?

24:48Patrick Gray: And it's like, so much stuff has got easier, right? Like, so a lot of stuff, there's some stuff in the cloud that just shouldn't be there, right? And I think Swig is a good example of that, right? It just, why trombone all your traffic, as you say, through some gateway in Germany, right? Like, why do that? It doesn't make sense. And I think also remote access, so much of this stuff, like if you want an idea where proxy, there's a couple of options on the market, but most of it's going through some CDN somewhere. And it just doesn't make sense really to be doing it that way all the time. I mean, it depends on the app, obviously, like it's going to make sense sometimes when you're dealing with a web app to throw that behind some sort of CDN with some off on it.

25:27Patrick Gray: But yeah, there's just some stuff that's been around a little bit too long and everybody accepts this is the way we do things because it's the way things are done. But then sometimes you've just got to take a step back and say the way we're doing things makes absolutely no sense. And I think the secure web gateway stuff, if you ask anyone listening to this, this is a paid promotional interview, sure. But if I ask anyone who's actually listened to this, which do you think is a better approach? Tromboning your traffic through some data center so that some company can try to break and inspect it and compare it against IOCs and stuff versus something that you've built that sits in the browser.

26:04Patrick Gray: Like if you could only pick one, everybody's going to pick your stuff. So yeah, it's interesting though, because I'm guessing too, and you tell me, riddle me this, do you get resistance from people when you propose switching to this approach or are they more like, oh, thank God, where do I sign? It's a very big ask to walk up to someone and go, hey, rip out your entire sassy platform, which is everything we've spoken about, access control, SWIG and CASB in one go and put us in instead. That is generally, you know, big, because people have spent years trying to get these things implemented because they're a pain to implement.

26:39So like, I think what happens more so is - Can you even do that?

26:42Patrick Gray: Because you're not offering the access control bit, right? No, no, exactly. But even if you were in a situation where you had some other solution for access control - and you wanted that even then it's a big ask. So in a couple of years from now, you and me go in on a joint tender. This is the scenario. Yes, I like it. Exactly, exactly that. Yeah, it's like generally people want to be able to run these things in parallel, right? And I think the great thing about the browser extension is it's such an easy deployment. It runs at a different layer of your stack. You're not running yet another endpoint sensor on your laptop or workstation or whatever.

27:17you're not having to ship some big appliance or anything else you just go click click in an MDM and boom it's in every browser straight away and so it runs at this layer that you can run adjacent to everything else and obviously a lot everything we've built is stuff that nothing else in your stack picks up so people immediately see that value and they're using that in adjacent then initially sort of go oh I'm going to rip Sassy out but it's just after a while of using it after six months or so you start to go well hang on a minute I'm finding that I'm using this more frequently because it's more granular, it's more modern.

27:49It's like, I'm not having to backhaul everything. And you just find that slowly you're using those other features a lot less. And we've seen more and more people then sort of switching it off at Renewal and starting to move over to us. And we've just been listening to the demand of what people want. And whichever features people need in order to be able to do that, we've been building it for them. So yeah, it's just been a constant trend for us.

28:12Patrick Gray: Yeah, slowly, slowly catchy monkey, right? Like that makes a lot of sense. It makes a lot of sense. You're giving me ideas here too. So this is good. This is good. I'm taking notes. Now, just to change topics for a moment. Earlier, I was like describing sort of DLP agents and stuff and client software like outside the browser that runs on, you know, corporate endpoints as being mega jank stuff that was like coded in the 90s. You are actually, and I did mention this early in the podcast, you're actually planning to build some tooling outside the browser as well. This is a big change for the company, right?

28:49Patrick Gray: Because thus far you've been just inside, just confined to the browser. But you are actually going to build some sort of endpoint software that runs in conjunction with your extension. Makes me scared. Makes me scared because, you know, that's a big step. But then again, I mean, the science of creating that sort of software is better understood these days. It tends to be less janky. What's the plan? and how are you going to make sure it's not mega jack? Yeah, no, great question. So it's like I was saying before, people are kind of allergic to having more than one sensor, especially when they're really, really heavy.

29:22And so you kind of want to replace something that's there rather than add something new. So like given the pull into, you know, people sort of saying, I don't really want to renew my Swig and Caspi anymore, that has an endpoint agent. It's kind of you can pull that out and put this in instead, right? So we're not moving out away from browser security and becoming an endpoint company. The goal is very much like browser security is the core. But the thing that's really interesting about it is that in the Chrome MPI, there's actually a messaging API built into the browser that allows browser extensions to talk to binaries.

29:59So if we install a binary...

30:00Patrick Gray: This is sort of freaky because I may have literally been reading Google's documentation on that today because of our thing. But anyway, do go on. Yeah, and it's really cool. It's really cool because basically what you do is you install an endpoint sensor, you register that binary, and then when the browser extension can actually invoke it to do commands to run stuff. So you can run like local models, you can like use it to inspect uploads and that kind of stuff. And what that means is that in tandem, the extension and the endpoint sensor together, you can do a lot more interesting stuff. Like for example, if someone doesn't upload, pause the upload with the extension, then pass that down to the endpoint sensor which can interrogate it in a lot more depth and then you know send that back and allow or deny that from happening right so it's kind of like an extension of the browser extension if you like in a way when you can offload certain questions too to ai and whatever i'm guessing you're going to be doing some of that right yeah exactly that and like rather than having like a full enterprise browser you could do like 99 percent with this endpoint sensor and those things combined you can do a ton of stuff there another one of the big reasons for us to move there is because a lot of people who are looking to move off of their swig and casby they go fairly what about non-browser traffic like i care 90 of my traffic is in the browser maybe even 99 in some cases but there are sometimes some binaries that talk out externally agents talk out externally now a lot which has really increased the amount of non-browser traffic that's happened so for us to move out to the browser it means we can actually then provide web filtering to all non-browser traffic as well we're monitoring agents and you You can see which agents are running.

31:35You can stop them from going like, they do stupid stuff like, hey, I want to get this task done. So I'm going to take all your company data and throw it on Pacebin just to persist for a little while while I move over to something else. And just being able to say like, hey, these agents are allowed to talk to only these domains. And under these conditions, they're allowed to talk to an even narrower set of domains and that kind of stuff as well.

31:53Patrick Gray: They still find a way to do stupid stuff. Just warning you there, pal. Like it's amazing. Like I think really the only way to stop that stuff from happening, the best shot we've got at that. I mean, there's companies like Sondera, right, who are trying to build in like that. You know, you can monitor the actual LLM and steer it when its trajectory starts going a bit screwy, when it starts trying to look for domains to actually do, you know, to use as a scratch pad kind of thing with all your customers' PII. I love what they're doing. I met the founders over there. It's really, really cool. Yeah, it's a really good, it's a super cool tech for sure.

32:26Patrick Gray: Look, that's not to say that having some basic, you know, controls around like domain allow listing and whatever are based on this software that you're building. I mean, that is a good idea. We're going to need that as well. But it's just like, man, trying to control these things is hard. You know how I see this, dude? It's like, you know, it's easy when you start talking about adding agents and it's like, oh my goodness, everyone's competing. But the kind of way I've thought, if you look at a real macro view, what have we done for two decades? We've secured humans. So on that level, everyone's competing.

32:53Like we're stopping humans doing dumb stuff. And now what's happened is like basically the population of the world's like 10x because we've also got agents to deal with now. So it's like everyone has to start taking agency into consideration.

33:06Patrick Gray: It's the thing that we've always been worst at in security, right? Is like actually looking after malicious insiders or insiders doing the wrong things. So, you know, I think at the end of this, another few years, we're going to be a lot better at that. But the next question I was going to ask was, you mentioned like enterprise browsers there. And I think that's really interesting because you're like, well, if you've got an endpoint agent and you've got an extension and you've got this sort of messaging protocol, This makes me wonder whether or not the market and the opportunity for fully fledged enterprise browsers is going to look quite so peachy in a couple of years.

33:41Patrick Gray: Now that we've got people like you doing this, now that we've got, you know, extensions now are better than they were when some of those companies were founded. So you can do a lot more with them. Add to that some software that runs next to the browser. you're getting pretty close to it and then you're not having to run some really exotic you know third-party browser which i know certain people feel uncomfortable about like you are kind of going after that full enterprise browser market it seems like yeah i mean the gap of the you know what you need a full browser for is closing pretty radically like you said browser extension ecosystem is just getting better and better once you're in the endpoint sensor the sky is the limit if the two can communicate together you can just do a ton of stuff as you said like people's browsers like their religion you know like it's yeah really really difficult to go out and say like please just can you just like stop using the browser that you've used forever and use this one instead like even though it looks very very similar which i do understand sort of chromium based there's something about it where like it hurts people personally to make that shift and it's kind of tough and so like yeah we just thought like let's not let's not be opinionated about what people and users use let's meet the users where they're at and we just focused on the bit that we know best about and the bit that we care about, which is the security of that.

34:55So just meet them where they're at, you carry on doing your thing and we will put this kind of guards around you to protect both you doing dumb stuff that's going to get the company owned like data going out and you clicking on stuff that's going to get you owned as well. So that's kind of the approach that we've taken.

35:12Patrick Gray: Yeah, that's it. That's it. All right, mate, we're going to wrap it up there. Adam Bateman, it's always such a pleasure to see you, my friend. I think we'll be recording a product demo too before the year is out. So I'll be seeing you again soon. But thank you very much for joining me for a long chat about all things push. I've really enjoyed it. Me too. Appreciate it, man.

35:48Thank you.