Menlo Security vs Island: Isolation cloud or enterprise Chromium?
Menlo Security when hybrid cloud isolation plus Secure Extension keeps users in browsers they already run. Island when a dedicated Chromium Enterprise Browser (and Extension/Desktop surfaces) is the last-mile work session.
On 17 March 2026 Island shipped the Island Enterprise Platform, extending the Island Enterprise Browser into consumer browsers, desktop apps, and network services under one policy fabric. A day later, on 18 March 2026, Menlo Security launched its Browser Security Platform story for humans and AI agents on the same last-mile surface: the browser session. Mid-stage teams comparing enterprise browser shortlists after those launches are not evaluating two twin SKUs.
This shortlist is last-mile browser security: remote browser isolation and secure enterprise browser controls that keep risky web and SaaS work from landing malware or leaking data on the endpoint. It is not a full SSE bake-off (that lives on Zscaler vs Netskope) and not a ZTNA-first VPN replacement (see Cloudflare Zero Trust vs Twingate). Extension-led browser guardrails beside Island already appear on LayerX vs Island.
| Primary use case | Hybrid secure enterprise browser: Menlo Cloud isolation for high-risk browsing plus Secure Extension for local visibility and DLP on trusted sites, keeping users in browsers they already run | A governed work session on one of Island’s paths: the Chromium Enterprise Browser, the Extension in consumer browsers, or Desktop. The Extension is not a mandatory replacement browser |
|---|---|---|
| How a bad day closes | Risky content executes in a disposable cloud container (ACR / Isolation Core lineage); safe rendering reaches the native browser; file sanitization and DLP reduce malware and exfil before the endpoint owns the session | Policy blocks copy/paste, download, upload, screenshot, and related last-mile actions inside Island; admin reviews session evidence; contractors stay in the work browser instead of a full VDI stack |
| Day-to-day workflow | Traffic steered to a Menlo tenant for isolation paths; Secure Extension pushed for trusted-site controls; one admin console for mix-and-match policy | Users install or are mandated onto Island; admins set browser rules by group; Extension covers consumer browsers where parity allows; Desktop extends policy to thick apps when licensed |
| Deploy | Clientless cloud tenant plus optional Secure Extension; any browser / managed or BYOD positioning on first-party pages | Chromium browser install across desktop and mobile OS list on first-party pages; Extension for Chrome, Edge, Safari, Firefox, and other Chromium browsers |
| License/pricing | Protect / Secure / Manage modules by user licenses; quote + estimate tool on menlosecurity.com. AWS Marketplace, checked 3 Oct 2026: MENLO SECURE INTERNET with Premium Support is 130 USD per licensed user for a 12-month contract, 0-99 users, US. The commitment is how many users you license to route browser traffic through the cloud service, not how much they browse. That dimension does not say Protect, Secure, Manage, or the Secure Extension are included | Sales quote on island.io. AWS Marketplace, checked 3 Oct 2026: one dimension, Island Enterprise Browser and Management Console, at 250,000 USD per unit for a 12-month contract. The listing says a unit is the users or installations you commit to, and the console is included rather than a separate line. It does not say the Island Extension is included. Do not multiply 250,000 by headcount. A per-user GBP figure was not re-checked in this research, so it is not repeated |
| Who operates it | Security teams that want isolation-first browser threat prevention without forcing a replacement browser across every cohort | IT / security teams choosing a path: the Enterprise Browser install, the Extension in browsers people already run, or Desktop for thick apps |
We reviewed Menlo Secure Enterprise Browser and pricing pages, Island Enterprise Browser and March 2026 platform press, AWS Marketplace contract rows for both, and a September 2026 practitioner comment naming Island, all on 2 Oct 2026. We did not run either product in a paid tenant, so this is not a hands-on benchmark.
Menlo Security
Island
Menlo remains an independent company backed by investors including Vista Equity Partners; it was not acquired into another browser vendor. In February 2025 Menlo acquired Votiro to deepen file and data security beside the browser platform. Island remains independent. Between these two, the weekly hire is still architecture: isolate risky web work in Menlo’s cloud while users keep Chrome or Edge, or put last-mile controls inside Island’s Chromium work browser.
Editions and pricing
Neither vendor posts a mid-stage credit-card total for a full production program on the marketing site. Use Marketplace and public-sector catalog rows as procurement signals with contract-scope caveats, then confirm modules and units on the quote.
| How you buy it now | Self-service estimate tool and sales quote for Protect / Secure / Manage user licenses; channel and Marketplace paths for Secure Internet packaging | Sales / private offer for Island Enterprise Browser and platform surfaces; Marketplace listing for browser + management console |
|---|---|---|
| Public units (2 Oct 2026) | AWS Marketplace MENLO SECURE INTERNET with Premium Support: 130 USD per licensed user for a 12-month contract, 0-99 users, US, checked 3 Oct 2026. One user is one person licensed to route browser traffic through the cloud service. The listing says contact Menlo for larger deployments or other regions. The commitment is the user count, not traffic volume | Island Enterprise Browser and Management Console: 250,000 USD per unit for a 12-month contract, checked 3 Oct 2026 on the AWS Marketplace listing. A unit is the users or installations you commit to. The Management Console is included, not a separate line. The dimension does not say the Island Extension is included. Do not turn 250,000 into a per-person worked example. A per-user GBP figure was not re-checked in this research, so it is not repeated |
| What the invoice covers | Isolation / Secure Internet building block toward the broader Browser Security Platform; confirm Protect / Secure / Manage mix, Secure Extension scope, File Security, Secure Application Access, and AI Agent Security on the quote | Enterprise Browser plus Management Console on the Marketplace dimension; confirm Extension, Desktop, and Enterprise Platform network/AI/data services as separate or bundled lines |
| Main buying consideration | Does the 130 USD per user, 12-month Secure Internet commitment match the isolation cohort you will steer, knowing Protect, Secure, Manage, and the Secure Extension are not named on that dimension? | Will you commit units of the Enterprise Browser and Management Console at 250,000 USD per unit per 12 months, or staff the Extension, which that dimension does not name? |
Isolation cloud vs work browser
| Control point | Menlo Secure Enterprise Browser splits high-risk sessions into the Menlo Cloud (Adaptive Clientless Rendering / Isolation Core lineage) and trusted-site visibility into the Secure Extension under one console | Island Enterprise Browser embeds security, visibility, and manageability in a Chromium-based work browser; Extension and Desktop extend the same policy idea beyond that install |
|---|---|---|
| Threat prevention shape | Cloud execution of risky content before it reaches the endpoint; HEAT Shield AI multimodal analysis; file reconstruction across 220+ types per first-party pages | Safe browsing, web filtering, exploit prevention, and last-mile action controls inside the managed browser session; VDI-reduction positioning for hybrid and contractor access |
| Browser choice | Marketed to work with browsers users already prefer; isolation does not require standardizing every cohort on one Chromium fork | Primary path standardizes work on Island; Extension path covers consumer browsers when extension parity is enough |
| Main buying consideration | Is remote isolation of high-risk tabs the control you will enforce even when a site needs an exception list? | Will you mandate (or strongly prefer) Island as the daily work browser for the cohorts that need last-mile DLP? |
Between these two, Menlo leans into cloud isolation plus optional local extension. Island leans into making the browser itself the policy enforcement surface.
Last-mile controls and DLP
| Data controls | Browser DLP (copy/paste, upload/download), AI Adaptive DLP masking, and GenAI portal guardrails documented on Secure Enterprise Browser pages; Secure Extension carries local controls on trusted destinations | Granular last-mile controls over copy, paste, download, upload, screenshot, watermarking, redaction, and related session actions inside the Enterprise Browser |
|---|---|---|
| Visibility | Session dashboards and browsing forensics / session recordings triggered by categories, users, or DLP events per first-party materials | Log browser behavior, screenshot critical actions, and ship context to SIEM; admin console oriented to group policy and investigation |
| AI / agent surface | March 2026 Browser Security Platform packaging adds AI Agent Security / guardian runtime messaging for browser agents and autonomous agents; confirm SKU boundaries on the quote | March 2026 Enterprise Platform adds AI Services and Extension coverage for AI browsers; last-mile controls aim at prompts and data at the moment of use |
| Main buying consideration | Do you need isolation-grade prevention plus DLP without owning every endpoint browser binary? | Do you need click-level last-mile governance that assumes Island (or its Extension) is present in the session? |
Both sell data loss prevention at the browser edge. The split is where enforcement lives: Menlo’s hybrid cloud and extension plane versus Island’s managed Chromium (and platform extensions) as the default work surface.
Deployment paths and their limits
| Deployment paths | Menlo’s product page describes two paths on one console. The Menlo Cloud isolates high-risk browsing. The Secure Extension is pushed into browsers people already run for visibility and DLP on trusted sites. Limitation of the cloud path: a site that breaks needs an exception, and that exception is no longer the isolated session. Limitation of the extension path: it is local control on trusted sites, not cloud isolation of high-risk content | Island’s Enterprise Browser page says users do not have to switch browsers. The Enterprise Browser is the full Chromium install. The Extension runs in Chrome, Edge, Safari, Firefox, and other Chromium browsers. Limitation of the browser path: the person runs Island. Limitation of the Extension path: Island says it supports most of the full browser, except where parity is not possible because of restrictions on extensions. The page does not name those gaps. Desktop is a separate surface for thick apps on macOS and Windows |
|---|---|---|
| BYOD / contractors | Clientless secure application access and isolation paths aimed at unmanaged devices without a full VDI rebuild | Either path can cover contractors: an Enterprise Browser install, or the Extension pushed through MDM without a browser switch. The Extension page says rollout is through the MDM you already use. Parity with the full browser is the limit |
| Ops ownership | Security owns tenant steering, isolation categories, extension rollout, and exception debt | IT/security owns the path you staff: browser packaging, Extension rollout, or both. A second-browser complaint shows up when the full browser is mandated. That is a choice, not a product requirement |
| Main buying consideration | Which Menlo path will you staff, cloud isolation or the Secure Extension, and which sites belong on each? | Which Island path will you staff, the Enterprise Browser or the Extension, knowing the Extension is real and not full parity? |
The main buying criterion is the path and its limit, before any one machine’s complaint. Menlo keeps the user’s browser: high-risk sessions go to the Menlo Cloud, and the Secure Extension covers trusted sites. Island can be the Enterprise Browser or the Extension in Chrome, Edge, Safari, or Firefox. Staff the path whose limit you accept.
That 2 September 2026 comment is one edge case, after the path choice above. One person was mandated onto the Island browser and said the work machine could not run it beside IDEs and Slack. It is not a rule that Island must replace the browser. The Extension path is how Island says people can stay in the browser they already run.
Where they overlap
Both compete for last-mile browser security budgets that used to buy pixel-streaming RBI, heavy VDI for web apps, or bolted-on DLP that never sees the session. An RFP that only says “secure enterprise browser” or “stop browser-borne malware and SaaS exfil” will draw demos from both. The remaining split is Menlo as isolation-first hybrid platform on browsers you already run versus Island as Chromium work-browser (plus platform surfaces) where policy lives inside the browser product.
Full SSE consolidation remains on Zscaler vs Netskope. Private-access ZTNA remains on Cloudflare Zero Trust vs Twingate. Extension-led browser security beside Island remains on LayerX vs Island.
When to use both
Running Menlo isolation and Island as duplicate systems of record for the same SaaS DLP cohort usually doubles exception ownership and confuses users about which browser path is “safe.” The narrow pattern that can appear is Island as the mandated work browser for high-sensitivity apps and contractors while Menlo isolation covers unmanaged or high-risk internet browsing for a different cohort – only if ownership of each path is explicit. If one team owns both queues, pick the packaging you will staff: isolation plus Secure Extension on existing browsers, or a Chromium Enterprise Browser mandate.
Choose Menlo Security when you will staff the Menlo Cloud for high-risk browsing and the Secure Extension for trusted sites in browsers people already run. The published cash figure that matches the cloud path is MENLO SECURE INTERNET with Premium Support at 130 USD per licensed user for a 12-month contract, 0-99 users, US. It does not include the rest of the platform by itself. Choose Island when you will staff a path Island actually sells: the Enterprise Browser, or the Extension in Chrome, Edge, Safari, Firefox, and other Chromium browsers, with Desktop if thick apps are in scope. The published cash figure is 250,000 USD per unit for a 12-month contract covering the Enterprise Browser and Management Console together. A unit is users or installations you commit to. That figure does not say the Extension is included, and it is not a worked per-person total.
FAQs
Did Vista Equity Partners acquire Menlo Security?
No. First-party and press materials describe Vista Equity Partners as an investor (alongside others). Menlo remains an independent company. Separately, Menlo acquired Votiro in February 2025 for file and data security capabilities.
Is this the same job as Zscaler or Netskope SSE?
No. Zscaler vs Netskope covers broader SSE / SASE packaging (SWG, CASB, and related network security services). Menlo vs Island covers last-mile browser isolation and enterprise browser controls. Some programs run browser security beside SSE; they are not interchangeable RFPs.
What public prices can buyers trust?
Checked 3 Oct 2026. MENLO SECURE INTERNET with Premium Support is 130 USD per licensed user for a 12-month contract, 0-99 users, US. The commitment is that user count. Protect, Secure, Manage, and the Secure Extension are not named on that dimension. Island Enterprise Browser and Management Console is 250,000 USD per unit for a 12-month contract. A unit is the users or installations you commit to, and the console is included. The dimension does not say the Island Extension is included. Do not multiply 250,000 by headcount. A per-user GBP figure was not re-checked in this research, so it is not repeated.
Does Menlo require users to switch browsers?
Menlo positions Secure Enterprise Browser as working with browsers users already run, combining Menlo Cloud isolation for high-risk traffic with a Secure Extension for local controls. Island’s own page says users do not have to switch browsers. The Extension is a path in Chrome, Edge, Safari, Firefox, and other Chromium browsers. It supports most of the full browser except where extension restrictions block parity. The Enterprise Browser install is the deeper path, not a mandatory replacement.
Who is this for mid-stage?
Mid-stage teams that already feel browser-borne malware, SaaS DLP gaps, contractor BYOD risk, or VDI cost for web apps, and that can either steer isolation traffic (Menlo) or staff an Island path (Enterprise Browser or Extension), without needing a full SSE rip-and-replace first.
Is this a hands-on bake-off?
No. The comparison uses first-party product and Marketplace pages plus community cross-check only. We did not install either product in a paid lab tenant.
