Remote Browser Isolation (RBI) is a security technique that executes web browsing sessions in an isolated, sandboxed container in the cloud rather than on the endpoint device, sending back only a safe rendering of the page. Active content and malware never reach the client browser, containing zero-day, browser-based threats before they touch the network.
Key takeaways
- RBI renders web sessions remotely; only a safe view reaches the endpoint.
- Malware on the browsed page never executes on the client device.
- Read-only mode and upload/download controls stop data exfiltration.
- RBI pairs with SWG policy, ATP, and DLP for layered web protection.
- Isolated sessions are torn down after use, so nothing persists remotely.
On this page: Why it mattersHow it worksTypesRBI & VersaFAQ
Why is RBI important?
The browser is the most common entry point for compromise: drive-by downloads, malicious ads, phishing pages, and watering-hole attacks all execute inside the tab, and one unpatched rendering-engine flaw can hand an attacker code execution before signature-based defenses see the payload. Traditional web security tries to identify bad content first; RBI sidesteps that problem by never letting page content execute on the endpoint at all.
That matters most for zero-day threats, where no signature exists to block them. It also matters for risky browsing organizations cannot simply forbid – newly registered domains, uncategorized URLs, or sites staff have a legitimate reason to visit despite elevated risk. Isolating those sessions gives security teams a middle option between allowing and denying outright.
What is RBI?
When a user’s browser requests a risky page, the secure web gateway diverts the session to the RBI service instead of connecting the client directly. The isolation service loads and executes the real page – JavaScript, plugins, and all – inside a disposable, sandboxed container in the cloud. The client browser never runs the page’s code; it receives only a reconstructed, sanitized representation and forwards clicks, scrolls, and keystrokes back to the remote container.
Because execution never happens on the endpoint, malware embedded in the page – including zero-day exploits with no known signature – is confined to the throwaway container, destroyed at session end. RBI profiles also govern the session’s risk surface: uploads and downloads can be blocked, scanned, or limited to preview only; form submissions and clipboard access can be restricted; and the session can be forced into read-only mode.
Types of RBI
Two rendering approaches dominate. Pixel streaming treats the remote browser as a video source: the isolation server renders the page and streams compressed frames to the client, which displays them in a lightweight viewer – isolating every element, at the cost of latency and bandwidth. DOM reconstruction instead parses the remote page’s Document Object Model, strips active and potentially malicious elements, and rebuilds a clean HTML document the client renders natively – lighter and more responsive, with a narrower guarantee that every active element was correctly sanitized.
Deployment also varies. Most RBI is a cloud service, provisioned by region and reached through a secure web gateway. Fewer deployments run on-premises appliances for organizations that cannot route browsing traffic to a third-party cloud, trading simplicity for data-residency control.
RBI & Versa
Versa delivers RBI as a cloud-based add-on within its SASE fabric, licensed on the Versa Secure Internet Access (VSIA) Professional and Elite bundles. RBI works alongside the secure web gateway and VOS™ cloud security features – sandboxing, antivirus, and data loss prevention – for a further line of defense against zero-day, browser-based attacks. Enabling it requires Concerto, one or more SWGs, and Advanced Security Cloud instances in each region; see Configure Remote Browser Isolation and Configure SASE Tenants.
Administrators build RBI profiles that set read-only mode, upload/download behavior, form and clipboard rules, and rendering mode, then attach the profile to an internet protection rule so matching sessions – suspicious or unknown URL categories – are redirected to isolation. Administrators monitor RBI activity – sessions, transfers, and threats – from Concerto’s security dashboards.
Frequently asked questions
What is the difference between RBI and a secure web gateway?
A secure web gateway inspects and filters web traffic by URL category, reputation, and policy, then allows or blocks the connection. RBI is an action a gateway can take on a matched session: instead of allowing or blocking, it isolates execution remotely.
Does RBI protect against zero-day browser exploits?
Yes – that is RBI’s core value. Because the page executes in a disposable remote container instead of on the endpoint, even a successful exploit is confined there and destroyed when the session ends, never reaching the client device or network.
Can RBI stop data exfiltration during a browsing session?
Yes, through profile settings. Administrators can disable file uploads and form submissions, block clipboard access between the session and the local desktop, or force the whole session into read-only mode, which removes interactivity and blocks uploads, downloads, and form entry.
What is the difference between pixel streaming and DOM reconstruction?
Pixel streaming sends a video-like stream of the rendered page, isolating every element but using more bandwidth and adding latency. DOM reconstruction parses and sanitizes the page’s document structure, then rebuilds it for the local browser to render natively – lighter, but a narrower filtering guarantee.
Does isolating a browsing session slow down the user’s experience?
There is some overhead, since every page loads on a remote server first, but the impact is smaller with DOM reconstruction than pixel streaming. Because RBI is typically applied selectively – to suspicious or uncategorized sites, not all browsing – most users rarely notice it.
More on RBI
If you want to learn more, these are sources we trust.
| NIST SP 800-207: Zero Trust Architecture | Cloud Security Alliance |
|---|---|
| The NIST standard defining the Zero Trust principles that isolation-based access like RBI is built to satisfy. | Vendor-neutral cloud security research and working-group guidance covering browser and web-session isolation. |
Related terms
If you’re reading about RBI, these are worth looking at next.
| Next-Generation Firewall | Intrusion Prevention System | Data Loss Prevention |
|---|---|---|
| The application-aware firewall that inspects traffic an SWG diverts to RBI, applying URL filtering alongside it. | A perimeter system that drops anomalous traffic – a layered defense RBI complements by isolating risky sessions instead. | Scans files uploaded or downloaded in an isolated RBI session, blocking violations before data leaves or malware enters. |