A CISO on moving his SOC off the reactive loop — and getting inline control over data and AI use across 5,500 devices, without replacing a browser or adding another endpoint agent.
Key Takeaways
- Reaction time to active threats dropped to around 12 minutes. Across 5,500 devices, Windows and Mac, with richer endpoint context reaching the SOC in real time.
- Shadow GenAI usage moved into policy, not blocked. Free-tier Claude and Copilot usage was found within days and routed through inline business justification prompts.
- “Say yes” became a security capability. Developers kept Firefox, the business kept Claude and Copilot, and the SOC kept full visibility across all of it.
The modern desktop is a moving target. Browsers, Microsoft 365, Slack, Teams, ChatGPT, Copilot, a long tail of extensions and vibe-coded internal apps — each one is a new surface a CISO is expected to secure, and most SOCs are losing ground to the rate at which these surfaces appear. Sector Alarm, a European security services group with 5,000+ employees across eight countries, was running that same reactive loop: an EDR that told the team about breaches after they’d already happened, and a diverse estate that no single category of product could cover.
This case study walks through what changed. How Sector Alarm’s CISO evaluated managed browsers, proxy-based approaches, and EDR extensions — and why none of them fit a diverse estate. How a customer-paced rollout across 5,500 devices drew almost no helpdesk traffic — and brought reaction time to active threats down to around 12 minutes. What the team found inside days about shadow GenAI usage, and how they moved it into policy without a confrontation. And why, as Craig put it, a proxy is a proxy — and that sentence framed the entire evaluation.
Get the full case study here:
Why these stories are becoming the norm
The Sector Alarm story is specific, but the shape of it isn’t. More and more security teams are hitting the same wall: the browser used to be the control point, and now there isn’t one browser anymore. ChatGPT runs a browser inside a browser. Every SaaS app is effectively a browser. Every new AI tool, every internal app the business builds on top of an LLM, every unmanaged extension is a new surface — and the CISO alternative is to chase each one with a new policy, a new integration, a new vendor review.
That chase doesn’t scale. It’s the reason enterprise browser rollouts stall, why proxy-based approaches leak at the seams, and why EDR extensions keep showing up as band-aids. The underlying problem is architectural, not procedural.
What Red Access does differently
Red Access delivers agentless browsing, SaaS and data security across every browser and app on the endpoint. Inspection happens at the session layer, inline — before data leaves the device — without replacing a browser, rolling out an extension, or adding another endpoint agent. It’s configuration, not deployment. Whatever’s next — a new AI tool, a new SaaS, a new browser-based app the business adopts next quarter — is already covered by the same control plane.
