What is Remote Browser Isolation (RBI)?

What it does

RBI moves the browser execution environment off the user's device and onto a remote render farm, a cloud server, or a dedicated virtual machine. When a user visits a website, the page loads and executes on that remote system. The user sees and interacts with the page through a pixel stream, a DOM mirror, or a read-only rendering. Scripts, exploits, and malicious downloads run in the remote container, not on the endpoint. After the session ends, the container is discarded.

Core functions include:

• Rendering all web content in an isolated remote environment
• Streaming a safe visual representation to the user's local browser or thin client
• Blocking file downloads or sanitizing them before delivery
• Preventing credential theft by disabling form fill on untrusted sites
• Destroying the remote container after each session or tab is closed

Why teams buy it

Drive-by downloads and browser exploits are a leading initial access vector. Patching browsers across a fleet takes time, and zero-day vulnerabilities appear faster than patch cycles. RBI removes the attack surface entirely by ensuring that web content never executes on the endpoint. Teams also use RBI to protect users who must visit high-risk or uncategorized URLs without blocking productivity. It fits inside a broader Endpoint Security program alongside Endpoint Protection Platforms and Endpoint Detection and Response tools.

What to look for

• Isolation method: pixel streaming, DOM mirroring, or hardware-enforced separation each carry different fidelity and performance trade-offs
• Latency and user experience: high-latency streams frustrate users and drive workarounds
• File sanitization (CDR): content disarm and reconstruction for downloaded files